{"id":95084,"date":"2026-08-16T08:25:29","date_gmt":"2026-08-16T00:25:29","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/95084.html"},"modified":"2026-08-16T08:25:29","modified_gmt":"2026-08-16T00:25:29","slug":"%e5%8f%8ctoken%e8%ae%a4%e8%af%81%e4%bd%93%e7%b3%bb%e6%b7%b1%e5%ba%a6%e6%8b%86%e8%a7%a3%ef%bc%9aspring-security-jwt-redis","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/95084.html","title":{"rendered":"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis"},"content":{"rendered":"

\u4f60\u4ee5\u4e3a\u767b\u5f55\u5c31\u662f"\u7528\u6237\u540d\u5bc6\u7801\u6362\u4e00\u4e2aToken"？\u5f53\u4f60\u7684\u7cfb\u7edf\u9700\u8981"\u8e22\u4eba\u4e0b\u7ebf"\u3001\u201c\u5355\u8bbe\u5907\u767b\u5f55\u201d\u3001"Token\u65e0\u611f\u5237\u65b0"\u65f6，\u4e00\u5207\u90fd\u53d8\u4e86\u3002 \u2014\u2014 \u4e00\u7bc7\u7528\u4ee3\u7801\u6d41\u7a0b\u62c6\u89e3\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u7684\u5b9e\u6218\u624b\u518c<\/p>\n

\u9605\u8bfb\u65f6\u95f4：\u7ea645\u5206\u949f | \u6db5\u76d6：\u53ccToken\u539f\u7406 \/ Spring Security\u8fc7\u6ee4\u94fe \/ JWT\u751f\u6210\u4e0e\u6821\u9a8c \/ Redis\u9ed1\u540d\u5355 \/ RBAC\u6743\u9650 \/ Token\u5237\u65b0 \/ \u5b89\u5168\u5b9e\u8df5<\/p>\n

\n

📑 \u76ee\u5f55<\/h3>\n
  • \u5e8f\u7ae0：\u4e3a\u4ec0\u4e48\u9700\u8981\u53ccToken？<\/li>\n
  • \u7b2c\u4e00\u5e55：JWT\u57fa\u7840 \u2014 Token\u957f\u4ec0\u4e48\u6837<\/li>\n
  • \u7b2c\u4e8c\u5e55：\u53ccToken\u67b6\u6784\u8bbe\u8ba1<\/li>\n
  • \u7b2c\u4e09\u5e55：\u767b\u5f55\u6d41\u7a0b\u5b8c\u6574\u62c6\u89e3<\/li>\n
  • \u7b2c\u56db\u5e55：\u8bf7\u6c42\u8ba4\u8bc1 \u2014 Filter Chain\u6267\u884c\u6d41\u7a0b<\/li>\n
  • \u7b2c\u4e94\u5e55：Token\u5237\u65b0\u673a\u5236<\/li>\n
  • \u7b2c\u516d\u5e55：\u767b\u51fa\u4e0eToken\u5931\u6548<\/li>\n
  • \u7b2c\u4e03\u5e55：RBAC\u6743\u9650\u6a21\u578b<\/li>\n
  • \u7b2c\u516b\u5e55：Spring Security\u914d\u7f6e\u67b6\u6784<\/li>\n
  • \u7b2c\u4e5d\u5e55：\u5b89\u5168\u6700\u4f73\u5b9e\u8df5<\/li>\n
  • \u53c2\u8003\u6587\u732e<\/li>\n
    \n

    🎬 \u5e8f\u7ae0：\u4e3a\u4ec0\u4e48\u9700\u8981\u53ccToken？<\/h3>\n

    \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

    \u4f20\u7edf\u8ba4\u8bc1\u65b9\u6848\u7684\u56f0\u5883<\/h4>\n

    \u65b9\u6848\u4e00：Session\u8ba4\u8bc1<\/p>\n

    \u7528\u6237\u767b\u5f55 -> \u670d\u52a1\u7aef\u521b\u5efaSession -> \u8fd4\u56deSessionID(Cookie)
    \n\u6bcf\u6b21\u8bf7\u6c42 -> \u5e26Cookie -> \u670d\u52a1\u7aef\u67e5Session<\/p>\n

    \u95ee\u9898：<\/p>\n

      \n
    • \u6709\u72b6\u6001：\u670d\u52a1\u7aef\u8981\u5b58Session，\u5206\u5e03\u5f0f\u73af\u5883\u4e0b\u8981\u5171\u4eabSession（\u7c98\u6027Session\/Redis Session）<\/li>\n
    • CSRF\u98ce\u9669：Cookie\u4f1a\u88ab\u81ea\u52a8\u643a\u5e26，\u5bb9\u6613\u88ab\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020<\/li>\n
    • \u8de8\u57df\u56f0\u96be：Cookie\u6709\u57df\u9650\u5236，\u524d\u540e\u7aef\u5206\u79bb\u67b6\u6784\u4e0d\u65b9\u4fbf<\/li>\n<\/ul>\n

      \u65b9\u6848\u4e8c：\u5355Token（\u4e00\u4e2aJWT\u641e\u5b9a\u4e00\u5207）<\/p>\n

      \u7528\u6237\u767b\u5f55 -> \u8fd4\u56de\u4e00\u4e2aJWT（\u6709\u6548\u671f30\u5929）
      \n\u6bcf\u6b21\u8bf7\u6c42 -> \u5e26JWT -> \u670d\u52a1\u7aef\u9a8c\u7b7e<\/p>\n

      \u95ee\u9898：<\/p>\n

        \n
      • \u5b89\u5168\u4e0e\u4f53\u9a8c\u7684\u77db\u76fe：\n
          \n
        • Token\u6709\u6548\u671f\u957f（\u598230\u5929）\u2192 \u7528\u6237\u4f53\u9a8c\u597d，\u4f46Token\u6cc4\u9732\u540e30\u5929\u5185\u65e0\u6cd5\u64a4\u9500<\/li>\n
        • Token\u6709\u6548\u671f\u77ed（\u598215\u5206\u949f）\u2192 \u5b89\u5168，\u4f46\u7528\u6237\u6bcf15\u5206\u949f\u5c31\u8981\u91cd\u65b0\u767b\u5f55<\/li>\n<\/ul>\n<\/li>\n
        • \u65e0\u6cd5\u8e22\u4eba\u4e0b\u7ebf：JWT\u4e00\u65e6\u7b7e\u53d1，\u5728\u6709\u6548\u671f\u5185\u65e0\u6cd5\u4f7f\u5176\u5931\u6548<\/li>\n<\/ul>\n

          \u53ccToken\u65b9\u6848：\u4e24\u5168\u5176\u7f8e<\/h4>\n

          \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n\nToken\u6709\u6548\u671f\u5b58\u50a8\u65b9\u5f0f\u72b6\u6001\u7528\u9014<\/tr>\n\n\n\n
          Access Token<\/td>\n15-30\u5206\u949f<\/td>\n\u5185\u5b58\/Header<\/td>\n\u65e0\u72b6\u6001<\/td>\n\u6bcf\u6b21API\u8bf7\u6c42\u643a\u5e26<\/td>\n<\/tr>\n
          Refresh Token<\/td>\n7-30\u5929<\/td>\nHttpOnly Cookie + Redis<\/td>\n\u6709\u72b6\u6001(Redis)<\/td>\n\u4ec5\u7528\u4e8e\u5237\u65b0Access Token<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          \u6838\u5fc3\u601d\u60f3：<\/p>\n

            \n
          • Access Token\u77ed\u547d \u2192 \u6cc4\u9732\u5371\u5bb3\u6709\u9650（\u6700\u591a15\u5206\u949f）<\/li>\n
          • Refresh Token\u957f\u547d \u2192 \u7528\u6237\u4f53\u9a8c\u597d（7\u5929\u514d\u767b\u5f55）<\/li>\n
          • Refresh Token\u5b58\u5728Redis \u2192 \u53ef\u4ee5\u968f\u65f6\u64a4\u9500（\u8e22\u4eba\u4e0b\u7ebf）<\/li>\n
          • Access Token\u65e0\u72b6\u6001 \u2192 \u6027\u80fd\u597d（\u4e0d\u9700\u8981\u67e5Redis）<\/li>\n<\/ul>\n

            🎯 \u4e00\u53e5\u8bdd\u603b\u7ed3： Access Token\u8d1f\u8d23"\u5feb"（\u65e0\u72b6\u6001，O(1)\u9a8c\u8bc1），Refresh Token\u8d1f\u8d23"\u53ef\u63a7"（\u6709\u72b6\u6001，\u53ef\u64a4\u9500）\u3002\u4e24\u8005\u914d\u5408，\u5b9e\u73b0\u5b89\u5168\u4e0e\u6027\u80fd\u7684\u6700\u4f18\u5e73\u8861\u3002<\/p>\n

            \n

            🔑 \u7b2c\u4e00\u5e55：JWT\u57fa\u7840 \u2014 Token\u957f\u4ec0\u4e48\u6837<\/h3>\n

            \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

            1.1 JWT\u7684\u4e09\u4e2a\u90e8\u5206<\/h4>\n

            JWT（JSON Web Token）\u7531\u4e09\u90e8\u5206\u7ec4\u6210，\u7528 . \u8fde\u63a5：<\/p>\n

            eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMDAxIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
            \n|______Header________|______Payload________|____________Signature________________|<\/p>\n

            \u2460 Header（\u5934\u90e8）<\/p>\n

            {<\/span>
            \n "alg"<\/span>:<\/span> "HS256"<\/span>,<\/span> \/\/ \u7b7e\u540d\u7b97\u6cd5<\/span>
            \n "typ"<\/span>:<\/span> "JWT"<\/span> \/\/ Token\u7c7b\u578b<\/span>
            \n}<\/span><\/p>\n

            \u2461 Payload（\u8f7d\u8377）<\/p>\n

            Access Token\u7684Payload：<\/p>\n

            {<\/span>
            \n "sub"<\/span>:<\/span> "1001"<\/span>,<\/span> \/\/ \u7528\u6237ID<\/span>
            \n "username"<\/span>:<\/span> "zhangsan"<\/span>,<\/span> \/\/ \u7528\u6237\u540d<\/span>
            \n "roles"<\/span>:<\/span> [<\/span>"admin"<\/span>,<\/span> "user"<\/span>]<\/span>,<\/span> \/\/ \u89d2\u8272\u5217\u8868<\/span>
            \n "permissions"<\/span>:<\/span> [<\/span>"blog:read"<\/span>,<\/span> "blog:write"<\/span>,<\/span> "user:manage"<\/span>]<\/span>,<\/span> \/\/ \u6743\u9650\u5217\u8868<\/span>
            \n "iat"<\/span>:<\/span> 1720000000<\/span>,<\/span> \/\/ \u7b7e\u53d1\u65f6\u95f4<\/span>
            \n "exp"<\/span>:<\/span> 1720000900<\/span>,<\/span> \/\/ \u8fc7\u671f\u65f6\u95f4（15\u5206\u949f\u540e）<\/span>
            \n "jti"<\/span>:<\/span> "a1b2c3d4-e5f6-7890"<\/span> \/\/ JWT\u552f\u4e00ID（\u7528\u4e8e\u9ed1\u540d\u5355）<\/span>
            \n}<\/span><\/p>\n

            Refresh Token\u7684Payload（\u7cbe\u7b80）：<\/p>\n

            {<\/span>
            \n "sub"<\/span>:<\/span> "1001"<\/span>,<\/span> \/\/ \u7528\u6237ID<\/span>
            \n "tokenVersion"<\/span>:<\/span> 5<\/span>,<\/span> \/\/ Token\u7248\u672c（\u7528\u4e8e\u6279\u91cf\u5931\u6548）<\/span>
            \n "iat"<\/span>:<\/span> 1720000000<\/span>,<\/span>
            \n "exp"<\/span>:<\/span> 1720604800<\/span> \/\/ \u8fc7\u671f\u65f6\u95f4（7\u5929\u540e）<\/span>
            \n}<\/span><\/p>\n

            \u2462 Signature（\u7b7e\u540d）<\/p>\n

            HMACSHA256(
            \n base64UrlEncode(header) + "." + base64UrlEncode(payload),
            \n secret_key
            \n)<\/p>\n

            \u7b7e\u540d\u7684\u4f5c\u7528：\u9632\u7be1\u6539\u3002\u4efb\u4f55\u4eba\u4fee\u6539\u4e86Header\u6216Payload，\u7b7e\u540d\u5c31\u5bf9\u4e0d\u4e0a\u4e86\u3002<\/p>\n

            1.2 Access Token vs Refresh Token \u8bbe\u8ba1\u539f\u5219<\/h4>\n\n\u7ef4\u5ea6Access TokenRefresh Token<\/tr>\n\n\n\n\n\n\n\n\n
            \u5305\u542b\u4fe1\u606f<\/td>\n\u7528\u6237ID\u3001\u89d2\u8272\u3001\u6743\u9650（\u5c3d\u91cf\u4e30\u5bcc）<\/td>\n\u7528\u6237ID\u3001tokenVersion（\u5c3d\u91cf\u5c11）<\/td>\n<\/tr>\n
            \u6709\u6548\u671f<\/td>\n15-30\u5206\u949f<\/td>\n7-30\u5929<\/td>\n<\/tr>\n
            \u4f20\u8f93\u65b9\u5f0f<\/td>\nAuthorization: Bearer header<\/td>\nHttpOnly Cookie<\/td>\n<\/tr>\n
            \u5b58\u50a8\u4f4d\u7f6e<\/td>\n\u524d\u7aef\u5185\u5b58\/\u53d8\u91cf<\/td>\nHttpOnly Cookie（\u524d\u7aef\u4e0d\u53ef\u89c1）<\/td>\n<\/tr>\n
            \u662f\u5426\u5b58Redis<\/td>\n\u274c \u4e0d\u5b58（\u65e0\u72b6\u6001）<\/td>\n\u2705 \u5b58（\u6709\u72b6\u6001，\u53ef\u64a4\u9500）<\/td>\n<\/tr>\n
            \u9a8c\u8bc1\u65b9\u5f0f<\/td>\n\u9a8c\u7b7e+\u68c0\u67e5\u8fc7\u671f+\u68c0\u67e5\u9ed1\u540d\u5355<\/td>\n\u9a8c\u7b7e+\u68c0\u67e5Redis\u662f\u5426\u5b58\u5728<\/td>\n<\/tr>\n
            \u6027\u80fd<\/td>\n\u6781\u5feb（\u4e0d\u67e5\u5e93）<\/td>\n\u8f83\u5feb（\u53ea\u67e5\u4e00\u6b21Redis）<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
            \n

            🏗\ufe0f \u7b2c\u4e8c\u5e55：\u53ccToken\u67b6\u6784\u8bbe\u8ba1<\/h3>\n

            2.1 \u6574\u4f53\u67b6\u6784<\/h4>\n

            \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
            \n\u2502 Frontend \u2502\u2500\u2500\u2500\u2500>\u2502 Spring Boot \u2502\u2500\u2500\u2500\u2500>\u2502 Redis \u2502
            \n\u2502 Vue \/ React \u2502<\u2500\u2500\u2500\u2500\u2502 Spring Security \u2502<\u2500\u2500\u2500\u2500\u2502 \u2502
            \n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518
            \n \u2502
            \n v
            \n \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
            \n \u2502 MySQL \u2502
            \n \u2502 (users) \u2502
            \n \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518<\/p>\n

            2.2 JwtUtil\u5b8c\u6574\u5b9e\u73b0<\/h4>\n

            @Component<\/span>
            \npublic<\/span> class<\/span> JwtUtil<\/span> {<\/span><\/p>\n

            @Value<\/span>(<\/span>"${jwt.secret}"<\/span>)<\/span>
            \n private<\/span> String<\/span> secret;<\/span><\/p>\n

            @Value<\/span>(<\/span>"${jwt.access-token-expiry}"<\/span>)<\/span>
            \n private<\/span> long<\/span> accessTokenExpiry;<\/span> \/\/ 15 * 60 * 1000 (15\u5206\u949f)<\/span><\/p>\n

            @Value<\/span>(<\/span>"${jwt.refresh-token-expiry}"<\/span>)<\/span>
            \n private<\/span> long<\/span> refreshTokenExpiry;<\/span> \/\/ 7 * 24 * 3600 * 1000 (7\u5929)<\/span><\/p>\n

            \/**
            \n * \u751f\u6210Access Token
            \n *\/<\/span>
            \n public<\/span> String<\/span> generateAccessToken<\/span>(<\/span>Long<\/span> userId,<\/span> String<\/span> username,<\/span>
            \n List<\/span><<\/span>String<\/span>><\/span><\/span> roles,<\/span> List<\/span><<\/span>String<\/span>><\/span><\/span> permissions)<\/span> {<\/span>
            \n Map<\/span><<\/span>String<\/span>,<\/span> Object<\/span>><\/span><\/span> claims =<\/span> new<\/span> HashMap<\/span><<\/span>><\/span><\/span>(<\/span>)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"sub"<\/span>,<\/span> String<\/span>.<\/span>valueOf<\/span>(<\/span>userId)<\/span>)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"username"<\/span>,<\/span> username)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"roles"<\/span>,<\/span> roles)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"permissions"<\/span>,<\/span> permissions)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"jti"<\/span>,<\/span> UUID<\/span>.<\/span>randomUUID<\/span>(<\/span>)<\/span>.<\/span>toString<\/span>(<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

            return<\/span> Jwts<\/span>.<\/span>builder<\/span>(<\/span>)<\/span>
            \n .<\/span>setClaims<\/span>(<\/span>claims)<\/span>
            \n .<\/span>setIssuedAt<\/span>(<\/span>new<\/span> Date<\/span>(<\/span>)<\/span>)<\/span>
            \n .<\/span>setExpiration<\/span>(<\/span>new<\/span> Date<\/span>(<\/span>System<\/span>.<\/span>currentTimeMillis<\/span>(<\/span>)<\/span> +<\/span> accessTokenExpiry)<\/span>)<\/span>
            \n .<\/span>signWith<\/span>(<\/span>SignatureAlgorithm<\/span>.<\/span>HS256<\/span>,<\/span> secret)<\/span>
            \n .<\/span>compact<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            \/**
            \n * \u751f\u6210Refresh Token
            \n *\/<\/span>
            \n public<\/span> String<\/span> generateRefreshToken<\/span>(<\/span>Long<\/span> userId,<\/span> int<\/span> tokenVersion)<\/span> {<\/span>
            \n Map<\/span><<\/span>String<\/span>,<\/span> Object<\/span>><\/span><\/span> claims =<\/span> new<\/span> HashMap<\/span><<\/span>><\/span><\/span>(<\/span>)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"sub"<\/span>,<\/span> String<\/span>.<\/span>valueOf<\/span>(<\/span>userId)<\/span>)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"tokenVersion"<\/span>,<\/span> tokenVersion)<\/span>;<\/span>
            \n claims.<\/span>put<\/span>(<\/span>"jti"<\/span>,<\/span> UUID<\/span>.<\/span>randomUUID<\/span>(<\/span>)<\/span>.<\/span>toString<\/span>(<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

            return<\/span> Jwts<\/span>.<\/span>builder<\/span>(<\/span>)<\/span>
            \n .<\/span>setClaims<\/span>(<\/span>claims)<\/span>
            \n .<\/span>setIssuedAt<\/span>(<\/span>new<\/span> Date<\/span>(<\/span>)<\/span>)<\/span>
            \n .<\/span>setExpiration<\/span>(<\/span>new<\/span> Date<\/span>(<\/span>System<\/span>.<\/span>currentTimeMillis<\/span>(<\/span>)<\/span> +<\/span> refreshTokenExpiry)<\/span>)<\/span>
            \n .<\/span>signWith<\/span>(<\/span>SignatureAlgorithm<\/span>.<\/span>HS256<\/span>,<\/span> secret)<\/span>
            \n .<\/span>compact<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            \/**
            \n * \u89e3\u6790Token（\u9a8c\u8bc1\u7b7e\u540d+\u8fc7\u671f）
            \n *\/<\/span>
            \n public<\/span> Claims<\/span> parseToken<\/span>(<\/span>String<\/span> token)<\/span> {<\/span>
            \n return<\/span> Jwts<\/span>.<\/span>parser<\/span>(<\/span>)<\/span>
            \n .<\/span>setSigningKey<\/span>(<\/span>secret)<\/span>
            \n .<\/span>parseClaimsJws<\/span>(<\/span>token)<\/span>
            \n .<\/span>getBody<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            \/**
            \n * \u5224\u65adToken\u662f\u5426\u8fc7\u671f
            \n *\/<\/span>
            \n public<\/span> boolean<\/span> isTokenExpired<\/span>(<\/span>String<\/span> token)<\/span> {<\/span>
            \n try<\/span> {<\/span>
            \n Claims<\/span> claims =<\/span> parseToken<\/span>(<\/span>token)<\/span>;<\/span>
            \n return<\/span> claims.<\/span>getExpiration<\/span>(<\/span>)<\/span>.<\/span>before<\/span>(<\/span>new<\/span> Date<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n }<\/span> catch<\/span> (<\/span>ExpiredJwtException<\/span> e)<\/span> {<\/span>
            \n return<\/span> true<\/span>;<\/span>
            \n }<\/span>
            \n }<\/span><\/p>\n

            public<\/span> String<\/span> extractUserId<\/span>(<\/span>String<\/span> token)<\/span> {<\/span>
            \n return<\/span> parseToken<\/span>(<\/span>token)<\/span>.<\/span>getSubject<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            public<\/span> String<\/span> extractJti<\/span>(<\/span>String<\/span> token)<\/span> {<\/span>
            \n return<\/span> parseToken<\/span>(<\/span>token)<\/span>.<\/span>getId<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span>
            \n}<\/span><\/p>\n

            2.3 LoginUser \u2014 \u81ea\u5b9a\u4e49UserDetails<\/h4>\n

            @Data<\/span>
            \npublic<\/span> class<\/span> LoginUser<\/span> implements<\/span> UserDetails<\/span> {<\/span><\/p>\n

            private<\/span> Long<\/span> id;<\/span>
            \n private<\/span> String<\/span> username;<\/span>
            \n private<\/span> String<\/span> password;<\/span>
            \n private<\/span> List<\/span><<\/span>String<\/span>><\/span><\/span> roles;<\/span>
            \n private<\/span> List<\/span><<\/span>String<\/span>><\/span><\/span> permissions;<\/span>
            \n private<\/span> Integer<\/span> status;<\/span><\/p>\n

            public<\/span> LoginUser<\/span>(<\/span>User<\/span> user,<\/span> List<\/span><<\/span>String<\/span>><\/span><\/span> roles,<\/span> List<\/span><<\/span>String<\/span>><\/span><\/span> permissions)<\/span> {<\/span>
            \n this<\/span>.<\/span>id =<\/span> user.<\/span>getId<\/span>(<\/span>)<\/span>;<\/span>
            \n this<\/span>.<\/span>username =<\/span> user.<\/span>getUsername<\/span>(<\/span>)<\/span>;<\/span>
            \n this<\/span>.<\/span>password =<\/span> user.<\/span>getPassword<\/span>(<\/span>)<\/span>;<\/span>
            \n this<\/span>.<\/span>roles =<\/span> roles;<\/span>
            \n this<\/span>.<\/span>permissions =<\/span> permissions;<\/span>
            \n this<\/span>.<\/span>status =<\/span> user.<\/span>getStatus<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            @Override<\/span>
            \n public<\/span> Collection<\/span><<\/span>?<\/span> extends<\/span> GrantedAuthority<\/span>><\/span><\/span> getAuthorities<\/span>(<\/span>)<\/span> {<\/span>
            \n List<\/span><<\/span>GrantedAuthority<\/span>><\/span><\/span> authorities =<\/span> new<\/span> ArrayList<\/span><<\/span>><\/span><\/span>(<\/span>)<\/span>;<\/span>
            \n roles.<\/span>forEach<\/span>(<\/span>r -><\/span> authorities.<\/span>add<\/span>(<\/span>new<\/span> SimpleGrantedAuthority<\/span>(<\/span>"ROLE_"<\/span> +<\/span> r)<\/span>)<\/span>)<\/span>;<\/span>
            \n permissions.<\/span>forEach<\/span>(<\/span>p -><\/span> authorities.<\/span>add<\/span>(<\/span>new<\/span> SimpleGrantedAuthority<\/span>(<\/span>p)<\/span>)<\/span>)<\/span>;<\/span>
            \n return<\/span> authorities;<\/span>
            \n }<\/span><\/p>\n

            @Override<\/span>
            \n public<\/span> String<\/span> getPassword<\/span>(<\/span>)<\/span> {<\/span> return<\/span> password;<\/span> }<\/span><\/p>\n

            @Override<\/span>
            \n public<\/span> String<\/span> getUsername<\/span>(<\/span>)<\/span> {<\/span> return<\/span> username;<\/span> }<\/span><\/p>\n

            @Override<\/span>
            \n public<\/span> boolean<\/span> isAccountNonExpired<\/span>(<\/span>)<\/span> {<\/span> return<\/span> true<\/span>;<\/span> }<\/span><\/p>\n

            @Override<\/span>
            \n public<\/span> boolean<\/span> isAccountNonLocked<\/span>(<\/span>)<\/span> {<\/span> return<\/span> status ==<\/span> 1<\/span>;<\/span> }<\/span><\/p>\n

            @Override<\/span>
            \n public<\/span> boolean<\/span> isCredentialsNonExpired<\/span>(<\/span>)<\/span> {<\/span> return<\/span> true<\/span>;<\/span> }<\/span><\/p>\n

            @Override<\/span>
            \n public<\/span> boolean<\/span> isEnabled<\/span>(<\/span>)<\/span> {<\/span> return<\/span> status ==<\/span> 1<\/span>;<\/span> }<\/span>
            \n}<\/span><\/p>\n

            2.4 \u6838\u5fc3\u7ec4\u4ef6\u6e05\u5355<\/h4>\n

            \u88681：\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6838\u5fc3\u7ec4\u4ef6<\/p>\n\n\u7ec4\u4ef6\u7c7b\u804c\u8d23<\/tr>\n\n\n\n\n\n\n\n\n
            JwtUtil<\/td>\n\u5de5\u5177\u7c7b<\/td>\nJWT\u751f\u6210\u3001\u89e3\u6790\u3001\u9a8c\u8bc1<\/td>\n<\/tr>\n
            JwtAuthenticationFilter<\/td>\nOncePerRequestFilter<\/td>\n\u4ece\u8bf7\u6c42\u4e2d\u63d0\u53d6JWT\u5e76\u8ba4\u8bc1<\/td>\n<\/tr>\n
            SecurityConfig<\/td>\n@Configuration<\/td>\n\u914d\u7f6eSpring Security\u8fc7\u6ee4\u94fe<\/td>\n<\/tr>\n
            AuthenticationController<\/td>\n@RestController<\/td>\n\u767b\u5f55\u3001\u5237\u65b0\u3001\u767b\u51fa\u63a5\u53e3<\/td>\n<\/tr>\n
            UserDetailsServiceImpl<\/td>\nUserDetailsService<\/td>\n\u4ece\u6570\u636e\u5e93\u52a0\u8f7d\u7528\u6237\u4fe1\u606f<\/td>\n<\/tr>\n
            RedisService<\/td>\nService<\/td>\nToken\u9ed1\u540d\u5355\u3001Refresh Token\u5b58\u50a8<\/td>\n<\/tr>\n
            User<\/td>\nEntity<\/td>\n\u7528\u6237\u5b9e\u4f53（\u542b\u89d2\u8272\u3001\u6743\u9650）<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            2.3 Redis Key\u8bbe\u8ba1<\/h4>\n

            # 1. Refresh Token\u5b58\u50a8（\u7528\u6237\u7ef4\u5ea6）
            \nKey: auth:refresh:{userId}
            \nValue: refreshTokenString
            \nTTL: 7\u5929<\/p>\n

            # 2. Access Token\u9ed1\u540d\u5355（Token\u7ef4\u5ea6，\u7528\u4e8e\u767b\u51fa\u540e\u4f7fToken\u5931\u6548）
            \nKey: auth:blacklist:{jti}
            \nValue: 1
            \nTTL: Access Token\u5269\u4f59\u6709\u6548\u671f（\u6700\u591a30\u5206\u949f）<\/p>\n

            # 3. Token\u7248\u672c\u53f7（\u7528\u6237\u7ef4\u5ea6，\u7528\u4e8e\u6279\u91cf\u5931\u6548\u6240\u6709Token）
            \nKey: auth:token:version:{userId}
            \nValue: versionNumber
            \nTTL: 30\u5929<\/p>\n

            # 4. \u767b\u5f55\u5931\u8d25\u8ba1\u6570（\u7528\u4e8e\u9632\u66b4\u529b\u7834\u89e3）
            \nKey: auth:login:fail:{username}
            \nValue: failCount
            \nTTL: 15\u5206\u949f<\/p>\n

            \n

            🔐 \u7b2c\u4e09\u5e55：\u767b\u5f55\u6d41\u7a0b\u5b8c\u6574\u62c6\u89e3<\/h3>\n

            \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

            3.1 \u5b8c\u6574\u767b\u5f55\u6d41\u7a0b（12\u6b65）<\/h4>\n

            Step 1：\u524d\u7aef\u53d1\u9001\u767b\u5f55\u8bf7\u6c42<\/p>\n

            POST \/auth\/login
            \nContent-Type: application\/json<\/p>\n

            {
            \n "username": "zhangsan",
            \n "password": "***"
            \n}<\/p>\n

            Step 2：Spring Security\u8fc7\u6ee4\u94fe\u62e6\u622a<\/p>\n

            \u8bf7\u6c42\u7ecf\u8fc7\u591a\u4e2aFilter，\u6700\u7ec8\u5230\u8fbe UsernamePasswordAuthenticationFilter（\u6216\u8005\u6211\u4eec\u81ea\u5b9a\u4e49\u7684\u767b\u5f55\u7aef\u70b9）\u3002<\/p>\n

            Step 3：\u6784\u5efaAuthentication\u5bf9\u8c61<\/p>\n

            UsernamePasswordAuthenticationToken<\/span> authRequest =<\/span>
            \n new<\/span> UsernamePasswordAuthenticationToken<\/span>(<\/span>username,<\/span> password)<\/span>;<\/span><\/p>\n

            Step 4：\u8c03\u7528AuthenticationManager.authenticate()<\/p>\n

            Authentication<\/span> authentication =<\/span> authenticationManager.<\/span>authenticate<\/span>(<\/span>authRequest)<\/span>;<\/span><\/p>\n

            Step 5：AuthenticationManager\u59d4\u6258\u7ed9AuthenticationProvider<\/p>\n

            \u9ed8\u8ba4\u4f7f\u7528 DaoAuthenticationProvider\u3002<\/p>\n

            Step 6：\u8c03\u7528UserDetailsService.loadUserByUsername()<\/p>\n

            @Override<\/span>
            \npublic<\/span> UserDetails<\/span> loadUserByUsername<\/span>(<\/span>String<\/span> username)<\/span> {<\/span>
            \n User<\/span> user =<\/span> userMapper.<\/span>selectByUsername<\/span>(<\/span>username)<\/span>;<\/span>
            \n if<\/span> (<\/span>user ==<\/span> null<\/span>)<\/span> {<\/span>
            \n throw<\/span> new<\/span> UsernameNotFoundException<\/span>(<\/span>"\u7528\u6237\u4e0d\u5b58\u5728"<\/span>)<\/span>;<\/span>
            \n }<\/span>
            \n \/\/ \u67e5\u8be2\u7528\u6237\u7684\u89d2\u8272\u548c\u6743\u9650<\/span>
            \n List<\/span><<\/span>String<\/span>><\/span><\/span> permissions =<\/span> permissionMapper.<\/span>selectByUserId<\/span>(<\/span>user.<\/span>getId<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n return<\/span> new<\/span> LoginUser<\/span>(<\/span>user,<\/span> permissions)<\/span>;<\/span>
            \n}<\/span><\/p>\n

            Step 7：\u5bc6\u7801\u6821\u9a8c<\/p>\n

            \/\/ DaoAuthenticationProvider\u5185\u90e8\u8c03\u7528<\/span>
            \npasswordEncoder.<\/span>matches<\/span>(<\/span>rawPassword,<\/span> encodedPassword)<\/span>
            \n\/\/ BCrypt\u52a0\u5bc6，\u6bcf\u6b21\u7ed3\u679c\u4e0d\u540c（\u52a0\u76d0），\u4e0d\u53ef\u9006<\/span><\/p>\n

            Step 8：\u8ba4\u8bc1\u6210\u529f，\u751f\u6210\u53ccToken<\/p>\n

            \/\/ \u751f\u6210Access Token（\u6709\u6548\u671f15\u5206\u949f）<\/span>
            \nString<\/span> accessToken =<\/span> jwtUtil.<\/span>generateAccessToken<\/span>(<\/span>user.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span>
            \n user.<\/span>getUsername<\/span>(<\/span>)<\/span>,<\/span> roles,<\/span> permissions)<\/span>;<\/span><\/p>\n

            \/\/ \u751f\u6210Refresh Token（\u6709\u6548\u671f7\u5929）<\/span>
            \nString<\/span> refreshToken =<\/span> jwtUtil.<\/span>generateRefreshToken<\/span>(<\/span>user.<\/span>getId<\/span>(<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

            Step 9：\u5c06Refresh Token\u5b58\u5165Redis<\/p>\n

            redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>set<\/span>(<\/span>
            \n "auth:refresh:"<\/span> +<\/span> user.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span>
            \n refreshToken,<\/span>
            \n 7<\/span>,<\/span> TimeUnit<\/span>.<\/span>DAYS<\/span>
            \n)<\/span>;<\/span><\/p>\n

            Step 10：\u8bbe\u7f6eHttpOnly Cookie（Refresh Token）<\/p>\n

            ResponseCookie<\/span> refreshCookie =<\/span> ResponseCookie<\/span>.<\/span>from<\/span>(<\/span>"refreshToken"<\/span>,<\/span> refreshToken)<\/span>
            \n .<\/span>httpOnly<\/span>(<\/span>true<\/span>)<\/span> \/\/ JS\u65e0\u6cd5\u8bfb\u53d6（\u9632XSS）<\/span>
            \n .<\/span>secure<\/span>(<\/span>true<\/span>)<\/span> \/\/ \u53ea\u5728HTTPS\u4e0b\u4f20\u8f93<\/span>
            \n .<\/span>sameSite<\/span>(<\/span>"Strict"<\/span>)<\/span> \/\/ \u9632CSRF<\/span>
            \n .<\/span>path<\/span>(<\/span>"\/"<\/span>)<\/span>
            \n .<\/span>maxAge<\/span>(<\/span>7<\/span> *<\/span> 24<\/span> *<\/span> 3600<\/span>)<\/span>
            \n .<\/span>build<\/span>(<\/span>)<\/span>;<\/span>
            \nresponse.<\/span>addHeader<\/span>(<\/span>"Set-Cookie"<\/span>,<\/span> refreshCookie.<\/span>toString<\/span>(<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

            Step 11：\u8fd4\u56deAccess Token + \u7528\u6237\u4fe1\u606f（\u54cd\u5e94\u4f53）<\/p>\n

            {<\/span>
            \n "code"<\/span>:<\/span> 200<\/span>,<\/span>
            \n "data"<\/span>:<\/span> {<\/span>
            \n "accessToken"<\/span>:<\/span> "eyJhbGciOiJIUzI1NiIs…"<\/span>,<\/span>
            \n "user"<\/span>:<\/span> {<\/span>
            \n "id"<\/span>:<\/span> 1001<\/span>,<\/span>
            \n "username"<\/span>:<\/span> "zhangsan"<\/span>,<\/span>
            \n "roles"<\/span>:<\/span> [<\/span>"admin"<\/span>,<\/span> "user"<\/span>]<\/span>,<\/span>
            \n "permissions"<\/span>:<\/span> [<\/span>"blog:read"<\/span>,<\/span> "blog:write"<\/span>,<\/span> "user:manage"<\/span>]<\/span>
            \n }<\/span>
            \n }<\/span>
            \n}<\/span><\/p>\n

            Step 12：\u524d\u7aef\u5b58\u50a8<\/p>\n

            \/\/ Access Token\u5b58\u5728\u5185\u5b58\u53d8\u91cf\u4e2d（\u5237\u65b0\u9875\u9762\u4f1a\u4e22\u5931，\u9700\u8981\u91cd\u65b0\u7528Refresh Token\u83b7\u53d6）<\/span>
            \nconst<\/span> accessToken =<\/span> response.<\/span>data.<\/span>accessToken;<\/span><\/p>\n

            \/\/ Refresh Token\u5728HttpOnly Cookie\u4e2d（\u524d\u7aef\u4ee3\u7801\u65e0\u6cd5\u8bbf\u95ee，\u4f46\u6d4f\u89c8\u5668\u4f1a\u81ea\u52a8\u643a\u5e26）<\/span>
            \n\/\/ \u524d\u7aef\u4e0d\u9700\u8981\u505a\u4efb\u4f55\u5904\u7406！<\/span><\/p>\n

            \n

            3.3 \u5b8c\u6574AuthenticationController<\/h4>\n

            \u4e0b\u9762\u662f\u5b8c\u6574\u7684Controller\u4ee3\u7801，\u5305\u542b\u767b\u5f55\u3001\u5237\u65b0\u3001\u767b\u51fa\u3001\u5168\u8bbe\u5907\u767b\u51fa\u3001\u83b7\u53d6\u5f53\u524d\u7528\u6237\u7b49\u6240\u6709\u7aef\u70b9：<\/p>\n

            @RestController<\/span>
            \n@RequestMapping<\/span>(<\/span>"\/auth"<\/span>)<\/span>
            \n@Slf4j<\/span>
            \npublic<\/span> class<\/span> AuthenticationController<\/span> {<\/span><\/p>\n

            @Autowired<\/span>
            \n private<\/span> AuthenticationManager<\/span> authenticationManager;<\/span>
            \n @Autowired<\/span>
            \n private<\/span> JwtUtil<\/span> jwtUtil;<\/span>
            \n @Autowired<\/span>
            \n private<\/span> UserService<\/span> userService;<\/span>
            \n @Autowired<\/span>
            \n private<\/span> RedisTemplate<\/span><<\/span>String<\/span>,<\/span> String<\/span>><\/span><\/span> redisTemplate;<\/span><\/p>\n

            private<\/span> static<\/span> final<\/span> int<\/span> MAX_LOGIN_FAIL<\/span> =<\/span> 5<\/span>;<\/span>
            \n private<\/span> static<\/span> final<\/span> int<\/span> LOGIN_FAIL_LOCK_MINUTES<\/span> =<\/span> 15<\/span>;<\/span><\/p>\n

            @PostMapping<\/span>(<\/span>"\/login"<\/span>)<\/span>
            \n public<\/span> Result<\/span><<\/span>LoginVO<\/span>><\/span><\/span> login<\/span>(<\/span>@RequestBody<\/span> LoginDTO<\/span> dto,<\/span> HttpServletResponse<\/span> response)<\/span> {<\/span>
            \n \/\/ 1. \u68c0\u67e5\u767b\u5f55\u5931\u8d25\u6b21\u6570<\/span>
            \n String<\/span> failKey =<\/span> "auth:login:fail:"<\/span> +<\/span> dto.<\/span>getUsername<\/span>(<\/span>)<\/span>;<\/span>
            \n String<\/span> failCount =<\/span> redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>get<\/span>(<\/span>failKey)<\/span>;<\/span>
            \n if<\/span> (<\/span>failCount !=<\/span> null<\/span> &&<\/span> Integer<\/span>.<\/span>parseInt<\/span>(<\/span>failCount)<\/span> >=<\/span> MAX_LOGIN_FAIL<\/span>)<\/span> {<\/span>
            \n return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>"\u767b\u5f55\u5931\u8d25\u6b21\u6570\u8fc7\u591a，\u8bf7\u7a0d\u540e\u91cd\u8bd5"<\/span>)<\/span>;<\/span>
            \n }<\/span>
            \n \/\/ 2. \u8ba4\u8bc1<\/span>
            \n Authentication<\/span> authentication;<\/span>
            \n try<\/span> {<\/span>
            \n authentication =<\/span> authenticationManager.<\/span>authenticate<\/span>(<\/span>
            \n new<\/span> UsernamePasswordAuthenticationToken<\/span>(<\/span>dto.<\/span>getUsername<\/span>(<\/span>)<\/span>,<\/span> dto.<\/span>getPassword<\/span>(<\/span>)<\/span>)<\/span>)<\/span>;<\/span>
            \n }<\/span> catch<\/span> (<\/span>BadCredentialsException<\/span> e)<\/span> {<\/span>
            \n redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>increment<\/span>(<\/span>failKey)<\/span>;<\/span>
            \n redisTemplate.<\/span>expire<\/span>(<\/span>failKey,<\/span> LOGIN_FAIL_LOCK_MINUTES<\/span>,<\/span> TimeUnit<\/span>.<\/span>MINUTES<\/span>)<\/span>;<\/span>
            \n return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>"\u7528\u6237\u540d\u6216\u5bc6\u7801\u9519\u8bef"<\/span>)<\/span>;<\/span>
            \n }<\/span>
            \n redisTemplate.<\/span>delete<\/span>(<\/span>failKey)<\/span>;<\/span>
            \n \/\/ 3. \u751f\u6210Token\u5bf9<\/span>
            \n LoginUser<\/span> loginUser =<\/span> (<\/span>LoginUser<\/span>)<\/span> authentication.<\/span>getPrincipal<\/span>(<\/span>)<\/span>;<\/span>
            \n int<\/span> version =<\/span> getTokenVersion<\/span>(<\/span>loginUser.<\/span>getId<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n String<\/span> accessToken =<\/span> jwtUtil.<\/span>generateAccessToken<\/span>(<\/span>loginUser.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span>
            \n loginUser.<\/span>getUsername<\/span>(<\/span>)<\/span>,<\/span> loginUser.<\/span>getRoles<\/span>(<\/span>)<\/span>,<\/span> loginUser.<\/span>getPermissions<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n String<\/span> refreshToken =<\/span> jwtUtil.<\/span>generateRefreshToken<\/span>(<\/span>loginUser.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span> version)<\/span>;<\/span>
            \n \/\/ 4. \u5b58Redis + \u8bbeCookie<\/span>
            \n redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>set<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> loginUser.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span> refreshToken,<\/span> 7<\/span>,<\/span> TimeUnit<\/span>.<\/span>DAYS<\/span>)<\/span>;<\/span>
            \n setRefreshTokenCookie<\/span>(<\/span>response,<\/span> refreshToken)<\/span>;<\/span>
            \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>new<\/span> LoginVO<\/span>(<\/span>accessToken,<\/span> loginUser.<\/span>toUserInfoVO<\/span>(<\/span>)<\/span>)<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            @PostMapping<\/span>(<\/span>"\/refresh"<\/span>)<\/span>
            \n public<\/span> Result<\/span><<\/span>TokenVO<\/span>><\/span><\/span> refresh<\/span>(<\/span>
            \n @CookieValue<\/span>(<\/span>value =<\/span> "refreshToken"<\/span>,<\/span> required =<\/span> false<\/span>)<\/span> String<\/span> refreshToken,<\/span>
            \n HttpServletResponse<\/span> response)<\/span> {<\/span>
            \n if<\/span> (<\/span>refreshToken ==<\/span> null<\/span>)<\/span> return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "\u7f3a\u5c11Refresh Token"<\/span>)<\/span>;<\/span>
            \n Claims<\/span> claims;<\/span>
            \n try<\/span> {<\/span> claims =<\/span> jwtUtil.<\/span>parseToken<\/span>(<\/span>refreshToken)<\/span>;<\/span> }<\/span>
            \n catch<\/span> (<\/span>ExpiredJwtException<\/span> e)<\/span> {<\/span> return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "Refresh Token\u5df2\u8fc7\u671f"<\/span>)<\/span>;<\/span> }<\/span>
            \n catch<\/span> (<\/span>Exception<\/span> e)<\/span> {<\/span> return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "Refresh Token\u65e0\u6548"<\/span>)<\/span>;<\/span> }<\/span>
            \n String<\/span> userId =<\/span> claims.<\/span>getSubject<\/span>(<\/span>)<\/span>;<\/span>
            \n String<\/span> stored =<\/span> redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>get<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> userId)<\/span>;<\/span>
            \n if<\/span> (<\/span>stored ==<\/span> null<\/span> ||<\/span> !<\/span>stored.<\/span>equals<\/span>(<\/span>refreshToken)<\/span>)<\/span> return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "Token\u5df2\u88ab\u64a4\u9500"<\/span>)<\/span>;<\/span>
            \n Integer<\/span> currentVer =<\/span> getTokenVersion<\/span>(<\/span>Long<\/span>.<\/span>parseLong<\/span>(<\/span>userId)<\/span>)<\/span>;<\/span>
            \n if<\/span> (<\/span>!<\/span>currentVer.<\/span>equals<\/span>(<\/span>claims.<\/span>get<\/span>(<\/span>"tokenVersion"<\/span>,<\/span> Integer<\/span>.<\/span>class<\/span>)<\/span>)<\/span>)<\/span> return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "\u7248\u672c\u4e0d\u5339\u914d"<\/span>)<\/span>;<\/span>
            \n LoginUser<\/span> user =<\/span> userService.<\/span>loadUserById<\/span>(<\/span>Long<\/span>.<\/span>parseLong<\/span>(<\/span>userId)<\/span>)<\/span>;<\/span>
            \n String<\/span> newAccess =<\/span> jwtUtil.<\/span>generateAccessToken<\/span>(<\/span>user.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span> user.<\/span>getUsername<\/span>(<\/span>)<\/span>,<\/span> user.<\/span>getRoles<\/span>(<\/span>)<\/span>,<\/span> user.<\/span>getPermissions<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n String<\/span> newRefresh =<\/span> jwtUtil.<\/span>generateRefreshToken<\/span>(<\/span>user.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span> currentVer)<\/span>;<\/span>
            \n redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>set<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> userId,<\/span> newRefresh,<\/span> 7<\/span>,<\/span> TimeUnit<\/span>.<\/span>DAYS<\/span>)<\/span>;<\/span>
            \n setRefreshTokenCookie<\/span>(<\/span>response,<\/span> newRefresh)<\/span>;<\/span>
            \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>new<\/span> TokenVO<\/span>(<\/span>newAccess)<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            @PostMapping<\/span>(<\/span>"\/logout"<\/span>)<\/span>
            \n public<\/span> Result<\/span><<\/span>Void<\/span>><\/span><\/span> logout<\/span>(<\/span>HttpServletRequest<\/span> request,<\/span> HttpServletResponse<\/span> response)<\/span> {<\/span>
            \n String<\/span> header =<\/span> request.<\/span>getHeader<\/span>(<\/span>"Authorization"<\/span>)<\/span>;<\/span>
            \n if<\/span> (<\/span>header !=<\/span> null<\/span> &&<\/span> header.<\/span>startsWith<\/span>(<\/span>"Bearer "<\/span>)<\/span>)<\/span> {<\/span>
            \n try<\/span> {<\/span>
            \n Claims<\/span> claims =<\/span> jwtUtil.<\/span>parseToken<\/span>(<\/span>header.<\/span>substring<\/span>(<\/span>7<\/span>)<\/span>)<\/span>;<\/span>
            \n long<\/span> remaining =<\/span> claims.<\/span>getExpiration<\/span>(<\/span>)<\/span>.<\/span>getTime<\/span>(<\/span>)<\/span> –<\/span> System<\/span>.<\/span>currentTimeMillis<\/span>(<\/span>)<\/span>;<\/span>
            \n if<\/span> (<\/span>remaining ><\/span> 0<\/span>)<\/span> redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>set<\/span>(<\/span>"auth:blacklist:"<\/span> +<\/span> claims.<\/span>getId<\/span>(<\/span>)<\/span>,<\/span> "1"<\/span>,<\/span> remaining,<\/span> TimeUnit<\/span>.<\/span>MILLISECONDS<\/span>)<\/span>;<\/span>
            \n redisTemplate.<\/span>delete<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> claims.<\/span>getSubject<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n }<\/span> catch<\/span> (<\/span>Exception<\/span> ignored)<\/span> {<\/span>}<\/span>
            \n }<\/span>
            \n clearRefreshTokenCookie<\/span>(<\/span>response)<\/span>;<\/span>
            \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            @PostMapping<\/span>(<\/span>"\/logout-all"<\/span>)<\/span>
            \n @PreAuthorize<\/span>(<\/span>"isAuthenticated()"<\/span>)<\/span>
            \n public<\/span> Result<\/span><<\/span>Void<\/span>><\/span><\/span> logoutAll<\/span>(<\/span>)<\/span> {<\/span>
            \n String<\/span> userId =<\/span> SecurityContextHolder<\/span>.<\/span>getContext<\/span>(<\/span>)<\/span>.<\/span>getAuthentication<\/span>(<\/span>)<\/span>.<\/span>getPrincipal<\/span>(<\/span>)<\/span>.<\/span>toString<\/span>(<\/span>)<\/span>;<\/span>
            \n redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>increment<\/span>(<\/span>"auth:token:version:"<\/span> +<\/span> userId)<\/span>;<\/span>
            \n redisTemplate.<\/span>expire<\/span>(<\/span>"auth:token:version:"<\/span> +<\/span> userId,<\/span> 30<\/span>,<\/span> TimeUnit<\/span>.<\/span>DAYS<\/span>)<\/span>;<\/span>
            \n redisTemplate.<\/span>delete<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> userId)<\/span>;<\/span>
            \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            private<\/span> int<\/span> getTokenVersion<\/span>(<\/span>Long<\/span> userId)<\/span> {<\/span>
            \n String<\/span> v =<\/span> redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>get<\/span>(<\/span>"auth:token:version:"<\/span> +<\/span> userId)<\/span>;<\/span>
            \n return<\/span> v !=<\/span> null<\/span> ?<\/span> Integer<\/span>.<\/span>parseInt<\/span>(<\/span>v)<\/span> :<\/span> 0<\/span>;<\/span>
            \n }<\/span><\/p>\n

            private<\/span> void<\/span> setRefreshTokenCookie<\/span>(<\/span>HttpServletResponse<\/span> response,<\/span> String<\/span> token)<\/span> {<\/span>
            \n response.<\/span>addHeader<\/span>(<\/span>"Set-Cookie"<\/span>,<\/span>
            \n ResponseCookie<\/span>.<\/span>from<\/span>(<\/span>"refreshToken"<\/span>,<\/span> token)<\/span>
            \n .<\/span>httpOnly<\/span>(<\/span>true<\/span>)<\/span>.<\/span>secure<\/span>(<\/span>true<\/span>)<\/span>.<\/span>sameSite<\/span>(<\/span>"Strict"<\/span>)<\/span>.<\/span>path<\/span>(<\/span>"\/"<\/span>)<\/span>.<\/span>maxAge<\/span>(<\/span>7<\/span>*<\/span>24<\/span>*<\/span>3600<\/span>)<\/span>.<\/span>toString<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            private<\/span> void<\/span> clearRefreshTokenCookie<\/span>(<\/span>HttpServletResponse<\/span> response)<\/span> {<\/span>
            \n response.<\/span>addHeader<\/span>(<\/span>"Set-Cookie"<\/span>,<\/span>
            \n ResponseCookie<\/span>.<\/span>from<\/span>(<\/span>"refreshToken"<\/span>,<\/span> ""<\/span>)<\/span>
            \n .<\/span>httpOnly<\/span>(<\/span>true<\/span>)<\/span>.<\/span>secure<\/span>(<\/span>true<\/span>)<\/span>.<\/span>sameSite<\/span>(<\/span>"Strict"<\/span>)<\/span>.<\/span>path<\/span>(<\/span>"\/"<\/span>)<\/span>.<\/span>maxAge<\/span>(<\/span>0<\/span>)<\/span>.<\/span>toString<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n }<\/span>
            \n}<\/span><\/p>\n

            3.4 \u524d\u7aefAuth Store（Pinia + Axios\u62e6\u622a\u5668）<\/h4>\n

            \/\/ stores\/auth.ts<\/span>
            \nimport<\/span> {<\/span> defineStore }<\/span> from<\/span> 'pinia'<\/span>;<\/span>
            \nimport<\/span> axios from<\/span> 'axios'<\/span>;<\/span><\/p>\n

            export<\/span> const<\/span> useAuthStore =<\/span> defineStore<\/span>(<\/span>'auth'<\/span>,<\/span> {<\/span>
            \n state<\/span>:<\/span> (<\/span>)<\/span> =><\/span> (<\/span>{<\/span>
            \n accessToken:<\/span> null<\/span> as<\/span> string<\/span> |<\/span> null<\/span>,<\/span> \/\/ \u5185\u5b58\u53d8\u91cf，\u5237\u65b0\u9875\u9762\u4e22\u5931<\/span>
            \n user:<\/span> null<\/span> as<\/span> any<\/span>,<\/span>
            \n isRefreshing:<\/span> false<\/span>,<\/span>
            \n failedQueue:<\/span> [<\/span>]<\/span> as<\/span> Array<\/span><<\/span>{<\/span> resolve:<\/span> Function<\/span>;<\/span> reject:<\/span> Function<\/span> }<\/span>><\/span>,<\/span>
            \n }<\/span>)<\/span>,<\/span>
            \n getters:<\/span> {<\/span>
            \n isAuthenticated<\/span>:<\/span> (<\/span>s)<\/span> =><\/span> !<\/span>!<\/span>s.<\/span>accessToken,<\/span>
            \n hasRole<\/span>:<\/span> (<\/span>s)<\/span> =><\/span> (<\/span>role:<\/span> string<\/span>)<\/span> =><\/span> s.<\/span>user?.<\/span>roles?.<\/span>includes<\/span>(<\/span>role)<\/span> ??<\/span> false<\/span>,<\/span>
            \n hasPermission<\/span>:<\/span> (<\/span>s)<\/span> =><\/span> (<\/span>perm:<\/span> string<\/span>)<\/span> =><\/span> s.<\/span>user?.<\/span>permissions?.<\/span>includes<\/span>(<\/span>perm)<\/span> ??<\/span> false<\/span>,<\/span>
            \n }<\/span>,<\/span>
            \n actions:<\/span> {<\/span>
            \n async<\/span> login<\/span>(<\/span>username:<\/span> string<\/span>,<\/span> password:<\/span> string<\/span>)<\/span> {<\/span>
            \n const<\/span> res =<\/span> await<\/span> axios.<\/span>post<\/span>(<\/span>'\/auth\/login'<\/span>,<\/span> {<\/span> username,<\/span> password }<\/span>)<\/span>;<\/span>
            \n this<\/span>.<\/span>accessToken =<\/span> res.<\/span>data.<\/span>data.<\/span>accessToken;<\/span>
            \n this<\/span>.<\/span>user =<\/span> res.<\/span>data.<\/span>data.<\/span>userInfo;<\/span>
            \n axios.<\/span>defaults.<\/span>headers.<\/span>common[<\/span>'Authorization'<\/span>]<\/span> =<\/span> `<\/span>Bearer <\/span>${<\/span>this<\/span>.<\/span>accessToken}<\/span><\/span>`<\/span><\/span>;<\/span>
            \n }<\/span>,<\/span>
            \n async<\/span> refreshToken<\/span>(<\/span>)<\/span> {<\/span>
            \n const<\/span> res =<\/span> await<\/span> axios.<\/span>post<\/span>(<\/span>'\/auth\/refresh'<\/span>)<\/span>;<\/span>
            \n this<\/span>.<\/span>accessToken =<\/span> res.<\/span>data.<\/span>data.<\/span>accessToken;<\/span>
            \n axios.<\/span>defaults.<\/span>headers.<\/span>common[<\/span>'Authorization'<\/span>]<\/span> =<\/span> `<\/span>Bearer <\/span>${<\/span>this<\/span>.<\/span>accessToken}<\/span><\/span>`<\/span><\/span>;<\/span>
            \n return<\/span> this<\/span>.<\/span>accessToken;<\/span>
            \n }<\/span>,<\/span>
            \n async<\/span> logout<\/span>(<\/span>)<\/span> {<\/span>
            \n try<\/span> {<\/span> await<\/span> axios.<\/span>post<\/span>(<\/span>'\/auth\/logout'<\/span>)<\/span>;<\/span> }<\/span> catch<\/span> {<\/span>}<\/span>
            \n this<\/span>.<\/span>accessToken =<\/span> null<\/span>;<\/span>
            \n this<\/span>.<\/span>user =<\/span> null<\/span>;<\/span>
            \n delete<\/span> axios.<\/span>defaults.<\/span>headers.<\/span>common[<\/span>'Authorization'<\/span>]<\/span>;<\/span>
            \n }<\/span>,<\/span>
            \n processQueue<\/span>(<\/span>error:<\/span> any<\/span>,<\/span> token:<\/span> string<\/span> |<\/span> null<\/span>)<\/span> {<\/span>
            \n this<\/span>.<\/span>failedQueue.<\/span>forEach<\/span>(<\/span>(<\/span>{<\/span> resolve,<\/span> reject }<\/span>)<\/span> =><\/span> error ?<\/span> reject<\/span>(<\/span>error)<\/span> :<\/span> resolve<\/span>(<\/span>token)<\/span>)<\/span>;<\/span>
            \n this<\/span>.<\/span>failedQueue =<\/span> [<\/span>]<\/span>;<\/span>
            \n }<\/span>,<\/span>
            \n }<\/span>,<\/span>
            \n}<\/span>)<\/span>;<\/span><\/p>\n

            \/\/ Axios\u62e6\u622a\u5668\u914d\u7f6e（\u5728main.ts\u4e2d\u521d\u59cb\u5316）<\/span>
            \nlet<\/span> isRefreshing =<\/span> false<\/span>;<\/span>
            \naxios.<\/span>interceptors.<\/span>response.<\/span>use<\/span>(<\/span>
            \n (<\/span>res)<\/span> =><\/span> res,<\/span>
            \n async<\/span> (<\/span>error)<\/span> =><\/span> {<\/span>
            \n const<\/span> original =<\/span> error.<\/span>config;<\/span>
            \n if<\/span> (<\/span>error.<\/span>response?.<\/span>status ===<\/span> 401<\/span> &&<\/span> !<\/span>original.<\/span>_retry &&<\/span> original.<\/span>url !==<\/span> '\/auth\/refresh'<\/span>)<\/span> {<\/span>
            \n if<\/span> (<\/span>isRefreshing)<\/span> {<\/span>
            \n return<\/span> new<\/span> Promise<\/span><\/span>(<\/span>(<\/span>resolve,<\/span> reject)<\/span> =><\/span> {<\/span>
            \n useAuthStore<\/span>(<\/span>)<\/span>.<\/span>failedQueue.<\/span>push<\/span>(<\/span>{<\/span> resolve,<\/span> reject }<\/span>)<\/span>;<\/span>
            \n }<\/span>)<\/span>.<\/span>then<\/span>(<\/span>(<\/span>token)<\/span> =><\/span> {<\/span>
            \n original.<\/span>headers.<\/span>Authorization =<\/span> `<\/span>Bearer <\/span>${<\/span>token}<\/span><\/span>`<\/span><\/span>;<\/span>
            \n return<\/span> axios<\/span>(<\/span>original)<\/span>;<\/span>
            \n }<\/span>)<\/span>;<\/span>
            \n }<\/span>
            \n original.<\/span>_retry =<\/span> true<\/span>;<\/span>
            \n isRefreshing =<\/span> true<\/span>;<\/span>
            \n try<\/span> {<\/span>
            \n const<\/span> newToken =<\/span> await<\/span> useAuthStore<\/span>(<\/span>)<\/span>.<\/span>refreshToken<\/span>(<\/span>)<\/span>;<\/span>
            \n useAuthStore<\/span>(<\/span>)<\/span>.<\/span>processQueue<\/span>(<\/span>null<\/span>,<\/span> newToken)<\/span>;<\/span>
            \n original.<\/span>headers.<\/span>Authorization =<\/span> `<\/span>Bearer <\/span>${<\/span>newToken}<\/span><\/span>`<\/span><\/span>;<\/span>
            \n return<\/span> axios<\/span>(<\/span>original)<\/span>;<\/span>
            \n }<\/span> catch<\/span> (<\/span>e)<\/span> {<\/span>
            \n useAuthStore<\/span>(<\/span>)<\/span>.<\/span>processQueue<\/span>(<\/span>e,<\/span> null<\/span>)<\/span>;<\/span>
            \n useAuthStore<\/span>(<\/span>)<\/span>.<\/span>logout<\/span>(<\/span>)<\/span>;<\/span>
            \n window.<\/span>location.<\/span>href =<\/span> '\/login'<\/span>;<\/span>
            \n return<\/span> Promise<\/span>.<\/span>reject<\/span>(<\/span>e)<\/span>;<\/span>
            \n }<\/span> finally<\/span> {<\/span>
            \n isRefreshing =<\/span> false<\/span>;<\/span>
            \n }<\/span>
            \n }<\/span>
            \n return<\/span> Promise<\/span>.<\/span>reject<\/span>(<\/span>error)<\/span>;<\/span>
            \n }<\/span>
            \n)<\/span>;<\/span><\/p>\n

            3.5 \u5173\u952e\u8bbe\u8ba1\u51b3\u7b56<\/h4>\n

            \u88683：\u53ccToken\u8bbe\u8ba1\u5173\u952e\u51b3\u7b56<\/p>\n\n\u51b3\u7b56\u9009\u62e9\u7406\u7531<\/tr>\n\n\n\n\n\n\n\n\n\n
            Access Token\u5b58\u50a8\u4f4d\u7f6e<\/td>\nJS\u5185\u5b58\u53d8\u91cf<\/td>\nXSS\u65e0\u6cd5\u8bfb\u53d6（\u9664\u975e\u6709XSS\u6f0f\u6d1e）<\/td>\n<\/tr>\n
            Refresh Token\u5b58\u50a8\u4f4d\u7f6e<\/td>\nHttpOnly Cookie<\/td>\nJS\u5b8c\u5168\u65e0\u6cd5\u8bbf\u95ee，\u9632XSS<\/td>\n<\/tr>\n
            Refresh Token\u662f\u5426\u5b58Redis<\/td>\n\u662f<\/td>\n\u53ef\u64a4\u9500，\u53ef\u68c0\u67e5\u662f\u5426\u88ab\u76d7\u7528<\/td>\n<\/tr>\n
            Access Token\u662f\u5426\u5b58Redis<\/td>\n\u5426（\u4ec5\u9ed1\u540d\u5355）<\/td>\n\u65e0\u72b6\u6001\u9a8c\u8bc1，\u6027\u80fd\u6700\u4f18<\/td>\n<\/tr>\n
            \u5bc6\u7801\u52a0\u5bc6\u65b9\u5f0f<\/td>\nBCrypt(cost=12)<\/td>\n\u4e0d\u53ef\u9006，\u52a0\u76d0，\u6297\u66b4\u529b\u7834\u89e3<\/td>\n<\/tr>\n
            \u767b\u5f55\u5931\u8d25\u9650\u5236<\/td>\n5\u6b21\/15\u5206\u949f<\/td>\n\u9632\u66b4\u529b\u7834\u89e3，\u4e0d\u5f71\u54cd\u6b63\u5e38\u7528\u6237<\/td>\n<\/tr>\n
            Refresh Token Rotation<\/td>\n\u662f<\/td>\n\u9632\u6b62Token\u88ab\u76d7\u7528\u540e\u6301\u7eed\u4f7f\u7528<\/td>\n<\/tr>\n
            CSRF\u9632\u62a4<\/td>\nSameSite=Strict<\/td>\nCookie\u4e0d\u968f\u8de8\u7ad9\u8bf7\u6c42\u53d1\u9001<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
            \n

            🔍 \u7b2c\u56db\u5e55：\u8bf7\u6c42\u8ba4\u8bc1 \u2014 Filter Chain\u6267\u884c\u6d41\u7a0b<\/h3>\n

            \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

            4.1 Spring Security Filter Chain<\/h4>\n

            Spring Security\u7684\u6838\u5fc3\u662f\u4e00\u4e2a\u8fc7\u6ee4\u5668\u94fe（Filter Chain），\u6bcf\u4e2a\u8bf7\u6c42\u90fd\u8981\u7ecf\u8fc7\u8fd9\u4e2a\u94fe\u4e0a\u7684\u6240\u6709\u8fc7\u6ee4\u5668\u3002<\/p>\n

            \u88682：Spring Security\u6838\u5fc3\u8fc7\u6ee4\u5668（\u6309\u6267\u884c\u987a\u5e8f）<\/p>\n\n\u8fc7\u6ee4\u5668\u804c\u8d23\u662f\u5426\u9700\u8981\u81ea\u5b9a\u4e49<\/tr>\n\n\n\n\n\n\n\n\n
            SecurityContextPersistenceFilter<\/td>\n\u7ef4\u62a4SecurityContext<\/td>\n\u274c<\/td>\n<\/tr>\n
            CorsFilter<\/td>\n\u5904\u7406\u8de8\u57df\u8bf7\u6c42<\/td>\n\u2705 \u914d\u7f6e\u5141\u8bb8\u7684\u57df<\/td>\n<\/tr>\n
            CsrfFilter<\/td>\nCSRF\u9632\u62a4<\/td>\n\u274c JWT\u901a\u5e38\u7981\u7528<\/td>\n<\/tr>\n
            **JwtAuthenticationFilter**<\/td>\nJWT\u8ba4\u8bc1（\u81ea\u5b9a\u4e49）<\/td>\n\u2705 \u6838\u5fc3<\/td>\n<\/tr>\n
            UsernamePasswordAuthenticationFilter<\/td>\n\u8868\u5355\u767b\u5f55<\/td>\n\u274c API\u767b\u5f55\u4e0d\u7528\u8fd9\u4e2a<\/td>\n<\/tr>\n
            ExceptionTranslationFilter<\/td>\n\u5904\u7406\u8ba4\u8bc1\/\u6388\u6743\u5f02\u5e38<\/td>\n\u2705 \u81ea\u5b9a\u4e49\u9519\u8bef\u54cd\u5e94<\/td>\n<\/tr>\n
            FilterSecurityInterceptor<\/td>\nURL\u7ea7\u522b\u7684\u6743\u9650\u5224\u65ad<\/td>\n\u2705 \u914d\u7f6eURL\u6743\u9650<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            4.2 JwtAuthenticationFilter \u2014 \u6838\u5fc3\u8ba4\u8bc1\u903b\u8f91<\/h4>\n

            @Component<\/span>
            \npublic<\/span> class<\/span> JwtAuthenticationFilter<\/span> extends<\/span> OncePerRequestFilter<\/span> {<\/span><\/p>\n

            @Autowired<\/span>
            \n private<\/span> JwtUtil<\/span> jwtUtil;<\/span>
            \n @Autowired<\/span>
            \n private<\/span> RedisTemplate<\/span><<\/span>String<\/span>,<\/span> String<\/span>><\/span><\/span> redisTemplate;<\/span><\/p>\n

            @Override<\/span>
            \n protected<\/span> void<\/span> doFilterInternal<\/span>(<\/span>HttpServletRequest<\/span> request,<\/span>
            \n HttpServletResponse<\/span> response,<\/span>
            \n FilterChain<\/span> filterChain)<\/span>
            \n throws<\/span> ServletException<\/span>,<\/span> IOException<\/span> {<\/span><\/p>\n

            \/\/ 1. \u63d0\u53d6Token<\/span>
            \n String<\/span> authHeader =<\/span> request.<\/span>getHeader<\/span>(<\/span>"Authorization"<\/span>)<\/span>;<\/span>
            \n if<\/span> (<\/span>authHeader ==<\/span> null<\/span> ||<\/span> !<\/span>authHeader.<\/span>startsWith<\/span>(<\/span>"Bearer "<\/span>)<\/span>)<\/span> {<\/span>
            \n filterChain.<\/span>doFilter<\/span>(<\/span>request,<\/span> response)<\/span>;<\/span> \/\/ \u6ca1\u6709Token，\u653e\u884c（\u540e\u7eed\u8fc7\u6ee4\u5668\u5904\u7406）<\/span>
            \n return<\/span>;<\/span>
            \n }<\/span>
            \n String<\/span> token =<\/span> authHeader.<\/span>substring<\/span>(<\/span>7<\/span>)<\/span>;<\/span><\/p>\n

            try<\/span> {<\/span>
            \n \/\/ 2. \u89e3\u6790Token（\u9a8c\u7b7e + \u68c0\u67e5\u8fc7\u671f）<\/span>
            \n Claims<\/span> claims =<\/span> jwtUtil.<\/span>parseToken<\/span>(<\/span>token)<\/span>;<\/span>
            \n String<\/span> jti =<\/span> claims.<\/span>getId<\/span>(<\/span>)<\/span>;<\/span>
            \n String<\/span> userId =<\/span> claims.<\/span>getSubject<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

            \/\/ 3. \u68c0\u67e5Redis\u9ed1\u540d\u5355（\u662f\u5426\u5df2\u767b\u51fa）<\/span>
            \n if<\/span> (<\/span>Boolean<\/span>.<\/span>TRUE<\/span>.<\/span>equals<\/span>(<\/span>redisTemplate.<\/span>hasKey<\/span>(<\/span>"auth:blacklist:"<\/span> +<\/span> jti)<\/span>)<\/span>)<\/span> {<\/span>
            \n throw<\/span> new<\/span> RuntimeException<\/span>(<\/span>"Token\u5df2\u88ab\u64a4\u9500"<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            \/\/ 4. \u63d0\u53d6\u6743\u9650\u4fe1\u606f<\/span>
            \n List<\/span><<\/span>String<\/span>><\/span><\/span> roles =<\/span> claims.<\/span>get<\/span>(<\/span>"roles"<\/span>,<\/span> List<\/span>.<\/span>class<\/span>)<\/span>;<\/span>
            \n List<\/span><<\/span>String<\/span>><\/span><\/span> permissions =<\/span> claims.<\/span>get<\/span>(<\/span>"permissions"<\/span>,<\/span> List<\/span>.<\/span>class<\/span>)<\/span>;<\/span>
            \n List<\/span><<\/span>GrantedAuthority<\/span>><\/span><\/span> authorities =<\/span> new<\/span> ArrayList<\/span><<\/span>><\/span><\/span>(<\/span>)<\/span>;<\/span>
            \n roles.<\/span>forEach<\/span>(<\/span>r -><\/span> authorities.<\/span>add<\/span>(<\/span>new<\/span> SimpleGrantedAuthority<\/span>(<\/span>"ROLE_"<\/span> +<\/span> r)<\/span>)<\/span>)<\/span>;<\/span>
            \n permissions.<\/span>forEach<\/span>(<\/span>p -><\/span> authorities.<\/span>add<\/span>(<\/span>new<\/span> SimpleGrantedAuthority<\/span>(<\/span>p)<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

            \/\/ 5. \u6784\u5efaAuthentication\u5bf9\u8c61<\/span>
            \n UsernamePasswordAuthenticationToken<\/span> authentication =<\/span>
            \n new<\/span> UsernamePasswordAuthenticationToken<\/span>(<\/span>userId,<\/span> null<\/span>,<\/span> authorities)<\/span>;<\/span>
            \n authentication.<\/span>setDetails<\/span>(<\/span>claims)<\/span>;<\/span><\/p>\n

            \/\/ 6. \u8bbe\u7f6e\u5230SecurityContext<\/span>
            \n SecurityContextHolder<\/span>.<\/span>getContext<\/span>(<\/span>)<\/span>.<\/span>setAuthentication<\/span>(<\/span>authentication)<\/span>;<\/span><\/p>\n

            }<\/span> catch<\/span> (<\/span>Exception<\/span> e)<\/span> {<\/span>
            \n \/\/ Token\u65e0\u6548，\u4e0d\u8bbe\u7f6eAuthentication，\u540e\u7eed\u4f1a\u8fd4\u56de401<\/span>
            \n log.<\/span>warn<\/span>(<\/span>"JWT\u9a8c\u8bc1\u5931\u8d25: {}"<\/span>,<\/span> e.<\/span>getMessage<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
            \n }<\/span><\/p>\n

            \/\/ 7. \u7ee7\u7eed\u6267\u884c\u8fc7\u6ee4\u94fe<\/span>
            \n filterChain.<\/span>doFilter<\/span>(<\/span>request,<\/span> response)<\/span>;<\/span>
            \n }<\/span>
            \n}<\/span><\/p>\n

            \u5173\u952e\u70b9：<\/p>\n

              \n
            • \u6b64Filter\u5728 UsernamePasswordAuthenticationFilter \u4e4b\u524d\u6267\u884c<\/li>\n
            • \u6ca1\u6709Token\u65f6\u76f4\u63a5\u653e\u884c（permitAll\u7684\u8def\u5f84\u4e0d\u9700\u8981Token）<\/li>\n
            • Token\u65e0\u6548\u65f6\u4e5f\u653e\u884c，\u4f46\u4e0d\u8bbe\u7f6eSecurityContext \u2192 \u540e\u7eed\u4f1a\u8fd4\u56de401<\/li>\n
            • \u6709Token\u4e14\u6709\u6548\u65f6，\u8bbe\u7f6eSecurityContext \u2192 \u540e\u7eedController\u53ef\u4ee5\u83b7\u53d6\u5f53\u524d\u7528\u6237<\/li>\n<\/ul>\n

              4.3 \u8ba4\u8bc1\u6d41\u7a0b\u56fe<\/h4>\n

              \u8bf7\u6c42\u5230\u8fbe
              \n \u2502
              \n \u25bc
              \n\u6709Authorization\u5934？
              \n \u2502
              \n \u251c\u2500\u2500 \u5426 \u2192 \u76f4\u63a5\u653e\u884c（\u540e\u7eed\u68c0\u67e5\u662f\u5426permitAll）
              \n \u2502
              \n \u25bc \u662f
              \n\u89e3\u6790JWT
              \n \u2502
              \n \u251c\u2500\u2500 \u89e3\u6790\u5931\u8d25（\u7b7e\u540d\u9519\u8bef\/\u683c\u5f0f\u9519\u8bef）\u2192 \u4e0d\u8bbe\u7f6e\u8ba4\u8bc1，\u653e\u884c \u2192 401
              \n \u2502
              \n \u251c\u2500\u2500 Token\u8fc7\u671f \u2192 \u4e0d\u8bbe\u7f6e\u8ba4\u8bc1，\u653e\u884c \u2192 401 TOKEN_EXPIRED
              \n \u2502
              \n \u251c\u2500\u2500 \u5728Redis\u9ed1\u540d\u5355\u4e2d \u2192 \u4e0d\u8bbe\u7f6e\u8ba4\u8bc1，\u653e\u884c \u2192 401 TOKEN_REVOKED
              \n \u2502
              \n \u25bc \u6709\u6548
              \n\u63d0\u53d6\u7528\u6237\u4fe1\u606f + \u6743\u9650
              \n \u2502
              \n \u25bc
              \n\u521b\u5efaAuthentication\u5bf9\u8c61，\u653e\u5165SecurityContext
              \n \u2502
              \n \u25bc
              \n\u7ee7\u7eed\u6267\u884c\u8fc7\u6ee4\u94fe \u2192 Controller\u5904\u7406\u8bf7\u6c42
              \n \u2502
              \n \u25bc
              \n@PreAuthorize\u68c0\u67e5\u6743\u9650 \u2192 \u901a\u8fc7\u5219\u8fd4\u56de\u6570\u636e \/ \u4e0d\u901a\u8fc7\u5219403<\/p>\n

              \n

              🔄 \u7b2c\u4e94\u5e55：Token\u5237\u65b0\u673a\u5236<\/h3>\n

              \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

              5.1 \u5237\u65b0\u6d41\u7a0b<\/h4>\n

              POST \/auth\/refresh
              \nCookie: refreshToken=eyJhbGciOiJIUzI1NiIs…<\/p>\n

              \u540e\u7aef\u5904\u7406\u903b\u8f91：<\/p>\n

              @PostMapping<\/span>(<\/span>"\/auth\/refresh"<\/span>)<\/span>
              \npublic<\/span> Result<\/span><<\/span>TokenVO<\/span>><\/span><\/span> refreshToken<\/span>(<\/span>
              \n @CookieValue<\/span>(<\/span>"refreshToken"<\/span>)<\/span> String<\/span> refreshToken,<\/span>
              \n HttpServletResponse<\/span> response)<\/span> {<\/span><\/p>\n

              \/\/ 1. \u9a8c\u8bc1Refresh Token\u7b7e\u540d\u548c\u8fc7\u671f<\/span>
              \n Claims<\/span> claims;<\/span>
              \n try<\/span> {<\/span>
              \n claims =<\/span> jwtUtil.<\/span>parseToken<\/span>(<\/span>refreshToken)<\/span>;<\/span>
              \n }<\/span> catch<\/span> (<\/span>ExpiredJwtException<\/span> e)<\/span> {<\/span>
              \n return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "Refresh Token\u5df2\u8fc7\u671f，\u8bf7\u91cd\u65b0\u767b\u5f55"<\/span>)<\/span>;<\/span>
              \n }<\/span> catch<\/span> (<\/span>Exception<\/span> e)<\/span> {<\/span>
              \n return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "Refresh Token\u65e0\u6548"<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              String<\/span> userId =<\/span> claims.<\/span>getSubject<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

              \/\/ 2. \u68c0\u67e5Redis\u4e2d\u662f\u5426\u5b58\u5728（\u662f\u5426\u88ab\u64a4\u9500）<\/span>
              \n String<\/span> storedToken =<\/span> redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>get<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> userId)<\/span>;<\/span>
              \n if<\/span> (<\/span>storedToken ==<\/span> null<\/span> ||<\/span> !<\/span>storedToken.<\/span>equals<\/span>(<\/span>refreshToken)<\/span>)<\/span> {<\/span>
              \n return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "Refresh Token\u5df2\u88ab\u64a4\u9500"<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              \/\/ 3. \u68c0\u67e5tokenVersion（\u662f\u5426\u88ab\u6279\u91cf\u64a4\u9500）<\/span>
              \n Integer<\/span> currentVersion =<\/span> redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>get<\/span>(<\/span>"auth:token:version:"<\/span> +<\/span> userId)<\/span>;<\/span>
              \n Integer<\/span> tokenVersion =<\/span> claims.<\/span>get<\/span>(<\/span>"tokenVersion"<\/span>,<\/span> Integer<\/span>.<\/span>class<\/span>)<\/span>;<\/span>
              \n if<\/span> (<\/span>currentVersion !=<\/span> null<\/span> &&<\/span> !<\/span>currentVersion.<\/span>equals<\/span>(<\/span>tokenVersion)<\/span>)<\/span> {<\/span>
              \n return<\/span> Result<\/span>.<\/span>fail<\/span>(<\/span>401<\/span>,<\/span> "Token\u7248\u672c\u4e0d\u5339\u914d，\u8bf7\u91cd\u65b0\u767b\u5f55"<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              \/\/ 4. \u751f\u6210\u65b0\u7684Token\u5bf9（Rotation：\u8f6e\u8f6c）<\/span>
              \n User<\/span> user =<\/span> userService.<\/span>getById<\/span>(<\/span>Long<\/span>.<\/span>parseLong<\/span>(<\/span>userId)<\/span>)<\/span>;<\/span>
              \n String<\/span> newAccessToken =<\/span> jwtUtil.<\/span>generateAccessToken<\/span>(<\/span>user)<\/span>;<\/span>
              \n String<\/span> newRefreshToken =<\/span> jwtUtil.<\/span>generateRefreshToken<\/span>(<\/span>user)<\/span>;<\/span><\/p>\n

              \/\/ 5. \u66f4\u65b0Redis（\u65e7\u7684Refresh Token\u81ea\u52a8\u5931\u6548）<\/span>
              \n redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>set<\/span>(<\/span>
              \n "auth:refresh:"<\/span> +<\/span> userId,<\/span>
              \n newRefreshToken,<\/span>
              \n 7<\/span>,<\/span> TimeUnit<\/span>.<\/span>DAYS<\/span>
              \n )<\/span>;<\/span><\/p>\n

              \/\/ 6. \u8bbe\u7f6e\u65b0\u7684Cookie<\/span>
              \n setRefreshTokenCookie<\/span>(<\/span>response,<\/span> newRefreshToken)<\/span>;<\/span><\/p>\n

              \/\/ 7. \u8fd4\u56de\u65b0\u7684Access Token<\/span>
              \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>new<\/span> TokenVO<\/span>(<\/span>newAccessToken)<\/span>)<\/span>;<\/span>
              \n}<\/span><\/p>\n

              5.2 \u524d\u7aef\u65e0\u611f\u5237\u65b0\u5b9e\u73b0<\/h4>\n

              \/\/ Axios\u54cd\u5e94\u62e6\u622a\u5668<\/span>
              \nlet<\/span> isRefreshing =<\/span> false<\/span>;<\/span>
              \nlet<\/span> failedQueue =<\/span> [<\/span>]<\/span>;<\/span><\/p>\n

              const<\/span> processQueue<\/span> =<\/span> (<\/span>error,<\/span> token =<\/span> null<\/span><\/span>)<\/span> =><\/span> {<\/span>
              \n failedQueue.<\/span>forEach<\/span>(<\/span>prom<\/span> =><\/span> {<\/span>
              \n if<\/span> (<\/span>error)<\/span> {<\/span>
              \n prom.<\/span>reject<\/span>(<\/span>error)<\/span>;<\/span>
              \n }<\/span> else<\/span> {<\/span>
              \n prom.<\/span>resolve<\/span>(<\/span>token)<\/span>;<\/span>
              \n }<\/span>
              \n }<\/span>)<\/span>;<\/span>
              \n failedQueue =<\/span> [<\/span>]<\/span>;<\/span>
              \n}<\/span>;<\/span><\/p>\n

              axios.<\/span>interceptors.<\/span>response.<\/span>use<\/span>(<\/span>
              \n response<\/span> =><\/span> response,<\/span>
              \n async<\/span> error<\/span> =><\/span> {<\/span>
              \n const<\/span> originalRequest =<\/span> error.<\/span>config;<\/span><\/p>\n

              \/\/ \u5982\u679c\u662f401\u4e14\u4e0d\u662f\u5237\u65b0\u8bf7\u6c42\u672c\u8eab，\u4e14\u6ca1\u6709\u91cd\u8bd5\u8fc7<\/span>
              \n if<\/span> (<\/span>error.<\/span>response?.<\/span>status ===<\/span> 401<\/span>
              \n &&<\/span> !<\/span>originalRequest.<\/span>_retry
              \n &&<\/span> originalRequest.<\/span>url !==<\/span> '\/auth\/refresh'<\/span>)<\/span> {<\/span><\/p>\n

              if<\/span> (<\/span>isRefreshing)<\/span> {<\/span>
              \n \/\/ \u6b63\u5728\u5237\u65b0\u4e2d，\u5c06\u8bf7\u6c42\u52a0\u5165\u961f\u5217<\/span>
              \n return<\/span> new<\/span> Promise<\/span>(<\/span>(<\/span>resolve,<\/span> reject<\/span>)<\/span> =><\/span> {<\/span>
              \n failedQueue.<\/span>push<\/span>(<\/span>{<\/span> resolve,<\/span> reject }<\/span>)<\/span>;<\/span>
              \n }<\/span>)<\/span>.<\/span>then<\/span>(<\/span>token<\/span> =><\/span> {<\/span>
              \n originalRequest.<\/span>headers.<\/span>Authorization =<\/span> 'Bearer '<\/span> +<\/span> token;<\/span>
              \n return<\/span> axios<\/span>(<\/span>originalRequest)<\/span>;<\/span>
              \n }<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              originalRequest.<\/span>_retry =<\/span> true<\/span>;<\/span>
              \n isRefreshing =<\/span> true<\/span>;<\/span><\/p>\n

              try<\/span> {<\/span>
              \n \/\/ \u8c03\u7528\u5237\u65b0\u63a5\u53e3<\/span>
              \n const<\/span> res =<\/span> await<\/span> axios.<\/span>post<\/span>(<\/span>'\/auth\/refresh'<\/span>)<\/span>;<\/span>
              \n const<\/span> newToken =<\/span> res.<\/span>data.<\/span>data.<\/span>accessToken;<\/span><\/p>\n

              \/\/ \u66f4\u65b0\u5185\u5b58\u4e2d\u7684Token<\/span>
              \n store.<\/span>setAccessToken<\/span>(<\/span>newToken)<\/span>;<\/span><\/p>\n

              \/\/ \u91cd\u8bd5\u961f\u5217\u4e2d\u7684\u8bf7\u6c42<\/span>
              \n processQueue<\/span>(<\/span>null<\/span>,<\/span> newToken)<\/span>;<\/span><\/p>\n

              \/\/ \u91cd\u8bd5\u539f\u59cb\u8bf7\u6c42<\/span>
              \n originalRequest.<\/span>headers.<\/span>Authorization =<\/span> 'Bearer '<\/span> +<\/span> newToken;<\/span>
              \n return<\/span> axios<\/span>(<\/span>originalRequest)<\/span>;<\/span><\/p>\n

              }<\/span> catch<\/span> (<\/span>refreshError)<\/span> {<\/span>
              \n processQueue<\/span>(<\/span>refreshError,<\/span> null<\/span>)<\/span>;<\/span>
              \n \/\/ Refresh Token\u4e5f\u8fc7\u671f\u4e86，\u8df3\u8f6c\u767b\u5f55\u9875<\/span>
              \n store.<\/span>logout<\/span>(<\/span>)<\/span>;<\/span>
              \n router.<\/span>push<\/span>(<\/span>'\/login'<\/span>)<\/span>;<\/span>
              \n return<\/span> Promise.<\/span>reject<\/span>(<\/span>refreshError)<\/span>;<\/span>
              \n }<\/span> finally<\/span> {<\/span>
              \n isRefreshing =<\/span> false<\/span>;<\/span>
              \n }<\/span>
              \n }<\/span><\/p>\n

              return<\/span> Promise.<\/span>reject<\/span>(<\/span>error)<\/span>;<\/span>
              \n }<\/span>
              \n)<\/span>;<\/span><\/p>\n

              5.3 Refresh Token\u8f6e\u8f6c（Rotation）<\/h4>\n

              \u4e3a\u4ec0\u4e48\u6bcf\u6b21\u5237\u65b0\u90fd\u8981\u6362\u4e00\u4e2a\u65b0\u7684Refresh Token？<\/p>\n

              \u8fd9\u53eb"Refresh Token Rotation"，\u9632\u6b62Refresh Token\u88ab\u76d7\u7528：<\/p>\n

              \u6b63\u5e38\u6d41\u7a0b：
              \nRT1 (Redis\u4e2d) -> \u5237\u65b0 -> \u8fd4\u56deAT2 + RT2 -> RT1\u4eceRedis\u5220\u9664，RT2\u5b58\u5165Redis<\/p>\n

              \u653b\u51fb\u573a\u666f：
              \n\u7528\u6237\u7684RT1\u88ab\u653b\u51fb\u8005\u7a83\u53d6
              \n\u7528\u6237\u7528RT1\u5237\u65b0 -> \u5f97\u5230AT2 + RT2 -> RT1\u5931\u6548
              \n\u653b\u51fb\u8005\u7528RT1\u5237\u65b0 -> \u53d1\u73b0RT1\u5df2\u5931\u6548（\u5df2\u88ab\u5220\u9664）-> \u5237\u65b0\u5931\u8d25！<\/p>\n

              \u5982\u679c\u4e0d\u7528Rotation，\u653b\u51fb\u8005\u548c\u7528\u6237\u53ef\u4ee5\u540c\u65f6\u4f7f\u7528\u540c\u4e00\u4e2aRefresh Token，\u76f4\u5230\u5b83\u8fc7\u671f\u3002<\/p>\n

              5.4 \u5e76\u53d1\u8bf7\u6c42\u7684Token\u5237\u65b0\u961f\u5217<\/h4>\n

              \u5f53\u524d\u7aef\u540c\u65f6\u53d1\u51fa5\u4e2a\u8bf7\u6c42，\u4e14Access Token\u6070\u597d\u8fc7\u671f\u65f6，5\u4e2a\u8bf7\u6c42\u90fd\u4f1a\u6536\u5230401\u3002\u5982\u679c\u6bcf\u4e2a\u90fd\u89e6\u53d1\u4e00\u6b21\u5237\u65b0，\u5c31\u4f1a\u4ea7\u751f\u7ade\u6001\u6761\u4ef6\u3002\u89e3\u51b3\u65b9\u6848\u662f\u8bf7\u6c42\u961f\u5217：<\/p>\n

              \/\/ \u6838\u5fc3\u903b\u8f91（\u5df2\u57283.4\u8282\u7684axios\u62e6\u622a\u5668\u4e2d\u5b9e\u73b0）<\/span>
              \n\/\/ 1. \u7b2c\u4e00\u4e2a401\u5230\u8fbe\u65f6，isRefreshing = true，\u5f00\u59cb\u5237\u65b0<\/span>
              \n\/\/ 2. \u540e\u7eed401\u5230\u8fbe\u65f6，\u4e0d\u89e6\u53d1\u5237\u65b0，\u800c\u662f\u52a0\u5165failedQueue\u7b49\u5f85<\/span>
              \n\/\/ 3. \u5237\u65b0\u6210\u529f\u540e，\u7528\u65b0Token\u91cd\u8bd5\u6240\u6709\u6392\u961f\u7684\u8bf7\u6c42<\/span>
              \n\/\/ 4. \u5237\u65b0\u5931\u8d25\u65f6，reject\u6240\u6709\u6392\u961f\u7684\u8bf7\u6c42，\u8df3\u8f6c\u767b\u5f55\u9875<\/span><\/p>\n

              \/\/ \u65f6\u5e8f\u56fe：<\/span>
              \n\/\/ Request1 -> 401 -> refresh() -> \u65b0Token -> \u91cd\u8bd5Request1<\/span>
              \n\/\/ Request2 -> 401 -> \u52a0\u5165\u961f\u5217 -> \u7b49\u5f85 -> \u7528\u65b0Token\u91cd\u8bd5<\/span>
              \n\/\/ Request3 -> 401 -> \u52a0\u5165\u961f\u5217 -> \u7b49\u5f85 -> \u7528\u65b0Token\u91cd\u8bd5<\/span>
              \n\/\/ Request4 -> 401 -> \u52a0\u5165\u961f\u5217 -> \u7b49\u5f85 -> \u7528\u65b0Token\u91cd\u8bd5<\/span>
              \n\/\/ Request5 -> 401 -> \u52a0\u5165\u961f\u5217 -> \u7b49\u5f85 -> \u7528\u65b0Token\u91cd\u8bd5<\/span>
              \n\/\/<\/span>
              \n\/\/ \u603b\u5171\u53ea\u5237\u65b0\u4e861\u6b21！\u907f\u514d\u4e86\u7ade\u6001\u6761\u4ef6\u3002<\/span><\/p>\n

              5.5 Token\u7eed\u671f\u7684\u7528\u6237\u4f53\u9a8c\u4f18\u5316<\/h4>\n\n\u573a\u666f\u5904\u7406\u65b9\u5f0f\u7528\u6237\u611f\u77e5<\/tr>\n\n\n\n\n\n
              Access Token\u672a\u8fc7\u671f<\/td>\n\u76f4\u63a5\u8bf7\u6c42<\/td>\n\u65e0\u611f\u77e5<\/td>\n<\/tr>\n
              Access Token\u8fc7\u671f，Refresh Token\u6709\u6548<\/td>\n\u81ea\u52a8\u5237\u65b0+\u91cd\u8bd5<\/td>\n\u65e0\u611f\u77e5（\u53ef\u80fd\u591a100ms\u5ef6\u8fdf）<\/td>\n<\/tr>\n
              Access Token\u8fc7\u671f，Refresh Token\u4e5f\u8fc7\u671f<\/td>\n\u8df3\u8f6c\u767b\u5f55\u9875<\/td>\n\u9700\u8981\u91cd\u65b0\u767b\u5f55<\/td>\n<\/tr>\n
              \u7528\u6237\u5728\u64cd\u4f5c\u4e2dToken\u5373\u5c06\u8fc7\u671f<\/td>\n\u524d\u7aef\u5b9a\u65f6\u5668\u63d0\u524d\u5237\u65b0<\/td>\n\u65e0\u611f\u77e5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              \u524d\u7aef\u5b9a\u65f6\u5237\u65b0（\u53ef\u9009\u4f18\u5316）：<\/p>\n

              \/\/ \u5728app\u542f\u52a8\u65f6\u8bbe\u7f6e\u5b9a\u65f6\u5668<\/span>
              \nconst<\/span> ACCESS_TOKEN_EXPIRY<\/span> =<\/span> 14<\/span> *<\/span> 60<\/span> *<\/span> 1000<\/span>;<\/span> \/\/ 14\u5206\u949f（Token\u6709\u6548\u671f15\u5206\u949f，\u63d0\u524d1\u5206\u949f\u5237\u65b0）<\/span>
              \nsetInterval<\/span>(<\/span>async<\/span> (<\/span>)<\/span> =><\/span> {<\/span>
              \n if<\/span> (<\/span>useAuthStore<\/span>(<\/span>)<\/span>.<\/span>isAuthenticated)<\/span> {<\/span>
              \n try<\/span> {<\/span>
              \n await<\/span> useAuthStore<\/span>(<\/span>)<\/span>.<\/span>refreshToken<\/span>(<\/span>)<\/span>;<\/span>
              \n }<\/span> catch<\/span> (<\/span>e)<\/span> {<\/span>
              \n console<\/span>.<\/span>warn<\/span>(<\/span>'Token refresh failed:'<\/span>,<\/span> e)<\/span>;<\/span>
              \n }<\/span>
              \n }<\/span>
              \n}<\/span>,<\/span> ACCESS_TOKEN_EXPIRY<\/span>)<\/span>;<\/span><\/p>\n

              \n

              🚪 \u7b2c\u516d\u5e55：\u767b\u51fa\u4e0eToken\u5931\u6548<\/h3>\n

              \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

              6.1 \u5355\u8bbe\u5907\u767b\u51fa<\/h4>\n

              @PostMapping<\/span>(<\/span>"\/auth\/logout"<\/span>)<\/span>
              \npublic<\/span> Result<\/span><<\/span>Void<\/span>><\/span><\/span> logout<\/span>(<\/span>HttpServletRequest<\/span> request,<\/span> HttpServletResponse<\/span> response)<\/span> {<\/span>
              \n \/\/ 1. \u4ece\u5f53\u524d\u8bf7\u6c42\u4e2d\u83b7\u53d6Access Token<\/span>
              \n String<\/span> authHeader =<\/span> request.<\/span>getHeader<\/span>(<\/span>"Authorization"<\/span>)<\/span>;<\/span>
              \n String<\/span> accessToken =<\/span> authHeader.<\/span>substring<\/span>(<\/span>7<\/span>)<\/span>;<\/span>
              \n Claims<\/span> claims =<\/span> jwtUtil.<\/span>parseToken<\/span>(<\/span>accessToken)<\/span>;<\/span>
              \n String<\/span> jti =<\/span> claims.<\/span>getId<\/span>(<\/span>)<\/span>;<\/span>
              \n String<\/span> userId =<\/span> claims.<\/span>getSubject<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

              \/\/ 2. \u5c06Access Token\u7684jti\u52a0\u5165\u9ed1\u540d\u5355<\/span>
              \n \/\/ TTL\u8bbe\u4e3aToken\u7684\u5269\u4f59\u6709\u6548\u671f（\u8fc7\u671f\u540e\u81ea\u52a8\u6e05\u7406）<\/span>
              \n long<\/span> remainingTime =<\/span> claims.<\/span>getExpiration<\/span>(<\/span>)<\/span>.<\/span>getTime<\/span>(<\/span>)<\/span> –<\/span> System<\/span>.<\/span>currentTimeMillis<\/span>(<\/span>)<\/span>;<\/span>
              \n if<\/span> (<\/span>remainingTime ><\/span> 0<\/span>)<\/span> {<\/span>
              \n redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>set<\/span>(<\/span>
              \n "auth:blacklist:"<\/span> +<\/span> jti,<\/span>
              \n "1"<\/span>,<\/span>
              \n remainingTime,<\/span> TimeUnit<\/span>.<\/span>MILLISECONDS<\/span>
              \n )<\/span>;<\/span>
              \n }<\/span><\/p>\n

              \/\/ 3. \u5220\u9664Redis\u4e2d\u7684Refresh Token<\/span>
              \n redisTemplate.<\/span>delete<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> userId)<\/span>;<\/span><\/p>\n

              \/\/ 4. \u6e05\u9664Cookie<\/span>
              \n ResponseCookie<\/span> clearCookie =<\/span> ResponseCookie<\/span>.<\/span>from<\/span>(<\/span>"refreshToken"<\/span>,<\/span> ""<\/span>)<\/span>
              \n .<\/span>httpOnly<\/span>(<\/span>true<\/span>)<\/span>
              \n .<\/span>secure<\/span>(<\/span>true<\/span>)<\/span>
              \n .<\/span>sameSite<\/span>(<\/span>"Strict"<\/span>)<\/span>
              \n .<\/span>path<\/span>(<\/span>"\/"<\/span>)<\/span>
              \n .<\/span>maxAge<\/span>(<\/span>0<\/span>)<\/span> \/\/ \u7acb\u5373\u8fc7\u671f<\/span>
              \n .<\/span>build<\/span>(<\/span>)<\/span>;<\/span>
              \n response.<\/span>addHeader<\/span>(<\/span>"Set-Cookie"<\/span>,<\/span> clearCookie.<\/span>toString<\/span>(<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

              return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>)<\/span>;<\/span>
              \n}<\/span><\/p>\n

              6.2 \u5168\u8bbe\u5907\u767b\u51fa（\u8e22\u4eba\u4e0b\u7ebf）<\/h4>\n

              @PostMapping<\/span>(<\/span>"\/auth\/logout-all"<\/span>)<\/span>
              \npublic<\/span> Result<\/span><<\/span>Void<\/span>><\/span><\/span> logoutAllDevices<\/span>(<\/span>@AuthenticationPrincipal<\/span> String<\/span> userId)<\/span> {<\/span>
              \n \/\/ \u9012\u589etokenVersion，\u6240\u6709\u65e7\u7248\u672c\u7684Token\u90fd\u4f1a\u5931\u6548<\/span>
              \n String<\/span> key =<\/span> "auth:token:version:"<\/span> +<\/span> userId;<\/span>
              \n redisTemplate.<\/span>opsForValue<\/span>(<\/span>)<\/span>.<\/span>increment<\/span>(<\/span>key)<\/span>;<\/span>
              \n redisTemplate.<\/span>expire<\/span>(<\/span>key,<\/span> 30<\/span>,<\/span> TimeUnit<\/span>.<\/span>DAYS<\/span>)<\/span>;<\/span><\/p>\n

              \/\/ \u5220\u9664Refresh Token<\/span>
              \n redisTemplate.<\/span>delete<\/span>(<\/span>"auth:refresh:"<\/span> +<\/span> userId)<\/span>;<\/span><\/p>\n

              return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>)<\/span>;<\/span>
              \n}<\/span><\/p>\n

              \u88683：Token\u5931\u6548\u7b56\u7565\u5bf9\u6bd4<\/p>\n\n\u7b56\u7565\u5b9e\u73b0\u65b9\u5f0f\u5f71\u54cd\u8303\u56f4\u4f7f\u7528\u573a\u666f<\/tr>\n\n\n\n\n\n
              Access Token\u9ed1\u540d\u5355<\/td>\nRedis SET blacklist:{jti}<\/td>\n\u5355\u4e2aToken<\/td>\n\u672c\u8bbe\u5907\u767b\u51fa<\/td>\n<\/tr>\n
              \u5220\u9664Refresh Token<\/td>\nRedis DEL refresh:{userId}<\/td>\n\u5f53\u524d\u8bbe\u5907\u7684\u5237\u65b0\u80fd\u529b<\/td>\n\u672c\u8bbe\u5907\u767b\u51fa<\/td>\n<\/tr>\n
              \u9012\u589etokenVersion<\/td>\nRedis INCR token:version:{userId}<\/td>\n\u8be5\u7528\u6237\u6240\u6709\u8bbe\u5907<\/td>\n\u4fee\u6539\u5bc6\u7801\u3001\u7ba1\u7406\u5458\u8e22\u4eba<\/td>\n<\/tr>\n
              \u6e05\u9664\u6240\u6709Token<\/td>\nDEL refresh + INCR version<\/td>\n\u8be5\u7528\u6237\u6240\u6709\u8bbe\u5907\u5168\u90e8\u4e0b\u7ebf<\/td>\n\u5b89\u5168\u4e8b\u4ef6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
              \n

              👥 \u7b2c\u4e03\u5e55：RBAC\u6743\u9650\u6a21\u578b<\/h3>\n

              \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

              7.1 \u6570\u636e\u5e93\u8bbe\u8ba1<\/h4>\n

              — \u7528\u6237\u8868<\/span>
              \nCREATE<\/span> TABLE<\/span> sys_user (<\/span>
              \n id BIGINT<\/span> PRIMARY<\/span> KEY<\/span> AUTO_INCREMENT<\/span>,<\/span>
              \n username VARCHAR<\/span>(<\/span>50<\/span>)<\/span> UNIQUE<\/span> NOT<\/span> NULL<\/span>,<\/span>
              \n password VARCHAR<\/span>(<\/span>100<\/span>)<\/span> NOT<\/span> NULL<\/span>,<\/span> — BCrypt\u52a0\u5bc6<\/span>
              \n status<\/span> TINYINT<\/span> DEFAULT<\/span> 1<\/span>,<\/span>
              \n created_at DATETIME<\/span> DEFAULT<\/span> CURRENT_TIMESTAMP<\/span>
              \n)<\/span>;<\/span><\/p>\n

              — \u89d2\u8272\u8868<\/span>
              \nCREATE<\/span> TABLE<\/span> sys_role (<\/span>
              \n id BIGINT<\/span> PRIMARY<\/span> KEY<\/span> AUTO_INCREMENT<\/span>,<\/span>
              \n role_name VARCHAR<\/span>(<\/span>50<\/span>)<\/span> NOT<\/span> NULL<\/span>,<\/span>
              \n role_key VARCHAR<\/span>(<\/span>50<\/span>)<\/span> UNIQUE<\/span> NOT<\/span> NULL<\/span> — \u5982 ADMIN, USER<\/span>
              \n)<\/span>;<\/span><\/p>\n

              — \u6743\u9650\u8868<\/span>
              \nCREATE<\/span> TABLE<\/span> sys_permission (<\/span>
              \n id BIGINT<\/span> PRIMARY<\/span> KEY<\/span> AUTO_INCREMENT<\/span>,<\/span>
              \n perm_name VARCHAR<\/span>(<\/span>100<\/span>)<\/span> NOT<\/span> NULL<\/span>,<\/span>
              \n perm_key VARCHAR<\/span>(<\/span>100<\/span>)<\/span> UNIQUE<\/span> NOT<\/span> NULL<\/span> — \u5982 blog:read, blog:write<\/span>
              \n)<\/span>;<\/span><\/p>\n

              — \u7528\u6237-\u89d2\u8272\u5173\u8054\u8868<\/span>
              \nCREATE<\/span> TABLE<\/span> sys_user_role (<\/span>
              \n user_id BIGINT<\/span> NOT<\/span> NULL<\/span>,<\/span>
              \n role_id BIGINT<\/span> NOT<\/span> NULL<\/span>,<\/span>
              \n PRIMARY<\/span> KEY<\/span> (<\/span>user_id,<\/span> role_id)<\/span>
              \n)<\/span>;<\/span><\/p>\n

              — \u89d2\u8272-\u6743\u9650\u5173\u8054\u8868<\/span>
              \nCREATE<\/span> TABLE<\/span> sys_role_permission (<\/span>
              \n role_id BIGINT<\/span> NOT<\/span> NULL<\/span>,<\/span>
              \n perm_id BIGINT<\/span> NOT<\/span> NULL<\/span>,<\/span>
              \n PRIMARY<\/span> KEY<\/span> (<\/span>role_id,<\/span> perm_id)<\/span>
              \n)<\/span>;<\/span><\/p>\n

              7.2 \u6743\u9650\u5d4c\u5165JWT<\/h4>\n

              \u767b\u5f55\u65f6，\u5c06\u7528\u6237\u7684\u6743\u9650\u5217\u8868\u5199\u5165JWT\u7684Payload：<\/p>\n

              public<\/span> String<\/span> generateAccessToken<\/span>(<\/span>LoginUser<\/span> loginUser)<\/span> {<\/span>
              \n Map<\/span><<\/span>String<\/span>,<\/span> Object<\/span>><\/span><\/span> claims =<\/span> new<\/span> HashMap<\/span><<\/span>><\/span><\/span>(<\/span>)<\/span>;<\/span>
              \n claims.<\/span>put<\/span>(<\/span>"sub"<\/span>,<\/span> String<\/span>.<\/span>valueOf<\/span>(<\/span>loginUser.<\/span>getUser<\/span>(<\/span>)<\/span>.<\/span>getId<\/span>(<\/span>)<\/span>)<\/span>)<\/span>;<\/span>
              \n claims.<\/span>put<\/span>(<\/span>"username"<\/span>,<\/span> loginUser.<\/span>getUsername<\/span>(<\/span>)<\/span>)<\/span>;<\/span>
              \n claims.<\/span>put<\/span>(<\/span>"roles"<\/span>,<\/span> loginUser.<\/span>getRoles<\/span>(<\/span>)<\/span>)<\/span>;<\/span> \/\/ ["admin", "user"]<\/span>
              \n claims.<\/span>put<\/span>(<\/span>"permissions"<\/span>,<\/span> loginUser.<\/span>getPermissions<\/span>(<\/span>)<\/span>)<\/span>;<\/span> \/\/ ["blog:read", "blog:write"]<\/span>
              \n claims.<\/span>put<\/span>(<\/span>"jti"<\/span>,<\/span> UUID<\/span>.<\/span>randomUUID<\/span>(<\/span>)<\/span>.<\/span>toString<\/span>(<\/span>)<\/span>)<\/span>;<\/span><\/p>\n

              return<\/span> Jwts<\/span>.<\/span>builder<\/span>(<\/span>)<\/span>
              \n .<\/span>setClaims<\/span>(<\/span>claims)<\/span>
              \n .<\/span>setIssuedAt<\/span>(<\/span>new<\/span> Date<\/span>(<\/span>)<\/span>)<\/span>
              \n .<\/span>setExpiration<\/span>(<\/span>new<\/span> Date<\/span>(<\/span>System<\/span>.<\/span>currentTimeMillis<\/span>(<\/span>)<\/span> +<\/span> 15<\/span> *<\/span> 60<\/span> *<\/span> 1000<\/span>)<\/span>)<\/span>
              \n .<\/span>signWith<\/span>(<\/span>SignatureAlgorithm<\/span>.<\/span>HS256<\/span>,<\/span> secret)<\/span>
              \n .<\/span>compact<\/span>(<\/span>)<\/span>;<\/span>
              \n}<\/span><\/p>\n

              7.3 \u524d\u7aef\u52a8\u6001\u8def\u7531\u4e0e\u6743\u9650\u6309\u94ae<\/h4>\n

              \/\/ router\/guard.ts \u2014 \u8def\u7531\u5b88\u536b<\/span>
              \nimport<\/span> {<\/span> useAuthStore }<\/span> from<\/span> '@\/stores\/auth'<\/span>;<\/span>
              \nimport<\/span> router from<\/span> '@\/router'<\/span>;<\/span><\/p>\n

              \/\/ \u52a8\u6001\u8def\u7531\u8868（\u6839\u636e\u6743\u9650\u751f\u6210）<\/span>
              \nconst<\/span> asyncRoutes =<\/span> [<\/span>
              \n {<\/span>
              \n path:<\/span> '\/admin'<\/span>,<\/span>
              \n component<\/span>:<\/span> (<\/span>)<\/span> =><\/span> import<\/span>(<\/span>'@\/layouts\/AdminLayout.vue'<\/span>)<\/span>,<\/span>
              \n meta:<\/span> {<\/span> roles:<\/span> [<\/span>'admin'<\/span>]<\/span> }<\/span>,<\/span> \/\/ \u9700\u8981admin\u89d2\u8272<\/span>
              \n children:<\/span> [<\/span>
              \n {<\/span> path:<\/span> 'users'<\/span>,<\/span> component<\/span>:<\/span> (<\/span>)<\/span> =><\/span> import<\/span>(<\/span>'@\/views\/admin\/Users.vue'<\/span>)<\/span>,<\/span> meta:<\/span> {<\/span> roles:<\/span> [<\/span>'admin'<\/span>]<\/span> }<\/span> }<\/span>,<\/span>
              \n {<\/span> path:<\/span> 'roles'<\/span>,<\/span> component<\/span>:<\/span> (<\/span>)<\/span> =><\/span> import<\/span>(<\/span>'@\/views\/admin\/Roles.vue'<\/span>)<\/span>,<\/span> meta:<\/span> {<\/span> roles:<\/span> [<\/span>'admin'<\/span>]<\/span> }<\/span> }<\/span>,<\/span>
              \n ]<\/span>
              \n }<\/span>,<\/span>
              \n {<\/span>
              \n path:<\/span> '\/blog'<\/span>,<\/span>
              \n component<\/span>:<\/span> (<\/span>)<\/span> =><\/span> import<\/span>(<\/span>'@\/layouts\/MainLayout.vue'<\/span>)<\/span>,<\/span>
              \n children:<\/span> [<\/span>
              \n {<\/span> path:<\/span> 'list'<\/span>,<\/span> component<\/span>:<\/span> (<\/span>)<\/span> =><\/span> import<\/span>(<\/span>'@\/views\/blog\/List.vue'<\/span>)<\/span> }<\/span>,<\/span> \/\/ \u5df2\u767b\u5f55\u5373\u53ef<\/span>
              \n {<\/span> path:<\/span> 'create'<\/span>,<\/span> component<\/span>:<\/span> (<\/span>)<\/span> =><\/span> import<\/span>(<\/span>'@\/views\/blog\/Create.vue'<\/span>)<\/span>,<\/span> meta:<\/span> {<\/span> permissions:<\/span> [<\/span>'blog:write'<\/span>]<\/span> }<\/span> }<\/span>,<\/span>
              \n {<\/span> path:<\/span> 'edit\/:id'<\/span>,<\/span> component<\/span>:<\/span> (<\/span>)<\/span> =><\/span> import<\/span>(<\/span>'@\/views\/blog\/Edit.vue'<\/span>)<\/span>,<\/span> meta:<\/span> {<\/span> permissions:<\/span> [<\/span>'blog:write'<\/span>]<\/span> }<\/span> }<\/span>,<\/span>
              \n ]<\/span>
              \n }<\/span>,<\/span>
              \n]<\/span>;<\/span><\/p>\n

              \/\/ \u8def\u7531\u524d\u7f6e\u5b88\u536b<\/span>
              \nrouter.<\/span>beforeEach<\/span>(<\/span>async<\/span> (<\/span>to,<\/span> from,<\/span> next)<\/span> =><\/span> {<\/span>
              \n const<\/span> authStore =<\/span> useAuthStore<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

              \/\/ 1. \u767d\u540d\u5355\u76f4\u63a5\u653e\u884c<\/span>
              \n if<\/span> (<\/span>[<\/span>'\/login'<\/span>,<\/span> '\/register'<\/span>,<\/span> '\/404'<\/span>]<\/span>.<\/span>includes<\/span>(<\/span>to.<\/span>path)<\/span>)<\/span> return<\/span> next<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

              \/\/ 2. \u672a\u767b\u5f55 -> \u5c1d\u8bd5\u7528Refresh Token\u6062\u590d<\/span>
              \n if<\/span> (<\/span>!<\/span>authStore.<\/span>isAuthenticated)<\/span> {<\/span>
              \n try<\/span> {<\/span>
              \n await<\/span> authStore.<\/span>refreshToken<\/span>(<\/span>)<\/span>;<\/span>
              \n }<\/span> catch<\/span> {<\/span>
              \n return<\/span> next<\/span>(<\/span>'\/login'<\/span>)<\/span>;<\/span>
              \n }<\/span>
              \n }<\/span><\/p>\n

              \/\/ 3. \u9996\u6b21\u8bbf\u95ee -> \u52a0\u8f7d\u52a8\u6001\u8def\u7531<\/span>
              \n if<\/span> (<\/span>!<\/span>router.<\/span>hasRoute<\/span>(<\/span>'admin'<\/span>)<\/span>)<\/span> {<\/span>
              \n asyncRoutes.<\/span>forEach<\/span>(<\/span>route =><\/span> {<\/span>
              \n if<\/span> (<\/span>!<\/span>route.<\/span>meta?.<\/span>roles ||<\/span> authStore.<\/span>hasRole<\/span>(<\/span>route.<\/span>meta.<\/span>roles[<\/span>0<\/span>]<\/span>)<\/span>)<\/span> {<\/span>
              \n router.<\/span>addRoute<\/span>(<\/span>route)<\/span>;<\/span>
              \n }<\/span>
              \n }<\/span>)<\/span>;<\/span>
              \n return<\/span> next<\/span>(<\/span>{<\/span> …<\/span>to,<\/span> replace:<\/span> true<\/span> }<\/span>)<\/span>;<\/span> \/\/ \u91cd\u65b0\u8fdb\u5165\u4ee5\u5339\u914d\u65b0\u8def\u7531<\/span>
              \n }<\/span><\/p>\n

              \/\/ 4. \u68c0\u67e5\u8def\u7531\u6743\u9650<\/span>
              \n if<\/span> (<\/span>to.<\/span>meta?.<\/span>roles &&<\/span> !<\/span>to.<\/span>meta.<\/span>roles.<\/span>some<\/span>(<\/span>(<\/span>r:<\/span> string<\/span>)<\/span> =><\/span> authStore.<\/span>hasRole<\/span>(<\/span>r)<\/span>)<\/span>)<\/span> {<\/span>
              \n return<\/span> next<\/span>(<\/span>'\/403'<\/span>)<\/span>;<\/span>
              \n }<\/span>
              \n if<\/span> (<\/span>to.<\/span>meta?.<\/span>permissions &&<\/span> !<\/span>to.<\/span>meta.<\/span>permissions.<\/span>some<\/span>(<\/span>(<\/span>p:<\/span> string<\/span>)<\/span> =><\/span> authStore.<\/span>hasPermission<\/span>(<\/span>p)<\/span>)<\/span>)<\/span> {<\/span>
              \n return<\/span> next<\/span>(<\/span>'\/403'<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              next<\/span>(<\/span>)<\/span>;<\/span>
              \n}<\/span>)<\/span>;<\/span><\/p>\n

              <!– \u6743\u9650\u6309\u94ae\u7ec4\u4ef6 components\/PermButton.vue –>
              \n<template>
              \n <button v-if="hasPerm" @click="$emit('click')" :class="btnClass">
              \n <slot \/>
              \n <\/button>
              \n<\/template><\/p>\n

              <script setup lang="ts">
              \nimport { computed } from 'vue';
              \nimport { useAuthStore } from '@\/stores\/auth';<\/p>\n

              const props = defineProps<{
              \n permission?: string; \/\/ \u5982 'blog:write'
              \n role?: string; \/\/ \u5982 'admin'
              \n btnClass?: string;
              \n}>();<\/p>\n

              const authStore = useAuthStore();
              \nconst hasPerm = computed(() => {
              \n if (props.permission) return authStore.hasPermission(props.permission);
              \n if (props.role) return authStore.hasRole(props.role);
              \n return true;
              \n});
              \n<\/script><\/p>\n

              <!– \u4f7f\u7528：\u53ea\u6709\u6709blog:write\u6743\u9650\u7684\u7528\u6237\u624d\u80fd\u770b\u5230\u201c\u7f16\u8f91\u201d\u6309\u94ae –>
              \n<!– <PermButton permission="blog:write" @click="editBlog">\u7f16\u8f91<\/PermButton> –><\/p>\n

              7.4 \u65b9\u6cd5\u7ea7\u6743\u9650\u63a7\u5236<\/h4>\n

              @RestController<\/span>
              \n@RequestMapping<\/span>(<\/span>"\/api\/blog"<\/span>)<\/span>
              \npublic<\/span> class<\/span> BlogController<\/span> {<\/span><\/p>\n

              \/\/ \u53ea\u6709admin\u89d2\u8272\u624d\u80fd\u8bbf\u95ee<\/span>
              \n @PreAuthorize<\/span>(<\/span>"hasRole('ADMIN')"<\/span>)<\/span>
              \n @DeleteMapping<\/span>(<\/span>"\/{id}"<\/span>)<\/span>
              \n public<\/span> Result<\/span><<\/span>Void<\/span>><\/span><\/span> deleteBlog<\/span>(<\/span>@PathVariable<\/span> Long<\/span> id)<\/span> {<\/span>
              \n blogService.<\/span>delete<\/span>(<\/span>id)<\/span>;<\/span>
              \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              \/\/ \u9700\u8981blog:write\u6743\u9650<\/span>
              \n @PreAuthorize<\/span>(<\/span>"hasAuthority('blog:write')"<\/span>)<\/span>
              \n @PostMapping<\/span>
              \n public<\/span> Result<\/span><<\/span>Void<\/span>><\/span><\/span> createBlog<\/span>(<\/span>@RequestBody<\/span> BlogDTO<\/span> dto)<\/span> {<\/span>
              \n blogService.<\/span>create<\/span>(<\/span>dto)<\/span>;<\/span>
              \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              \/\/ \u81ea\u5b9a\u4e49\u6743\u9650\u8868\u8fbe\u5f0f：\u53ea\u80fd\u64cd\u4f5c\u81ea\u5df1\u7684\u535a\u5ba2<\/span>
              \n @PreAuthorize<\/span>(<\/span>"#blog.userId == authentication.principal"<\/span>)<\/span>
              \n @PutMapping<\/span>(<\/span>"\/{id}"<\/span>)<\/span>
              \n public<\/span> Result<\/span><<\/span>Void<\/span>><\/span><\/span> updateBlog<\/span>(<\/span>@PathVariable<\/span> Long<\/span> id,<\/span> @RequestBody<\/span> BlogDTO<\/span> dto)<\/span> {<\/span>
              \n blogService.<\/span>update<\/span>(<\/span>id,<\/span> dto)<\/span>;<\/span>
              \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              \/\/ \u5df2\u767b\u5f55\u5373\u53ef\u8bbf\u95ee<\/span>
              \n @PreAuthorize<\/span>(<\/span>"isAuthenticated()"<\/span>)<\/span>
              \n @GetMapping<\/span>(<\/span>"\/{id}"<\/span>)<\/span>
              \n public<\/span> Result<\/span><<\/span>BlogVO<\/span>><\/span><\/span> getBlog<\/span>(<\/span>@PathVariable<\/span> Long<\/span> id)<\/span> {<\/span>
              \n return<\/span> Result<\/span>.<\/span>ok<\/span>(<\/span>blogService.<\/span>getById<\/span>(<\/span>id)<\/span>)<\/span>;<\/span>
              \n }<\/span>
              \n}<\/span><\/p>\n

              \n

              \u2699\ufe0f \u7b2c\u516b\u5e55：Spring Security\u914d\u7f6e\u67b6\u6784<\/h3>\n

              \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

              8.1 \u5b8c\u6574\u914d\u7f6e\u7c7b<\/h4>\n

              @Configuration<\/span>
              \n@EnableMethodSecurity<\/span> \/\/ \u542f\u7528\u65b9\u6cd5\u7ea7\u6743\u9650\u63a7\u5236<\/span>
              \npublic<\/span> class<\/span> SecurityConfig<\/span> {<\/span><\/p>\n

              @Autowired<\/span>
              \n private<\/span> JwtAuthenticationFilter<\/span> jwtAuthenticationFilter;<\/span><\/p>\n

              @Autowired<\/span>
              \n private<\/span> AuthenticationEntryPoint<\/span> authEntryPoint;<\/span><\/p>\n

              @Autowired<\/span>
              \n private<\/span> AccessDeniedHandler<\/span> accessDeniedHandler;<\/span><\/p>\n

              @Bean<\/span>
              \n public<\/span> SecurityFilterChain<\/span> filterChain<\/span>(<\/span>HttpSecurity<\/span> http)<\/span> throws<\/span> Exception<\/span> {<\/span>
              \n http
              \n \/\/ \u7981\u7528CSRF（JWT API\u4e0d\u9700\u8981）<\/span>
              \n .<\/span>csrf<\/span>(<\/span>csrf -><\/span> csrf.<\/span>disable<\/span>(<\/span>)<\/span>)<\/span><\/p>\n

              \/\/ \u65e0\u72b6\u6001Session（\u4e0d\u4f7f\u7528Session）<\/span>
              \n .<\/span>sessionManagement<\/span>(<\/span>session -><\/span>
              \n session.<\/span>sessionCreationPolicy<\/span>(<\/span>SessionCreationPolicy<\/span>.<\/span>STATELESS<\/span>)<\/span>)<\/span><\/p>\n

              \/\/ \u8bf7\u6c42\u6388\u6743\u89c4\u5219<\/span>
              \n .<\/span>authorizeHttpRequests<\/span>(<\/span>auth -><\/span> auth
              \n \/\/ \u516c\u5f00\u63a5\u53e3<\/span>
              \n .<\/span>requestMatchers<\/span>(<\/span>"\/auth\/login"<\/span>,<\/span> "\/auth\/refresh"<\/span>)<\/span>.<\/span>permitAll<\/span>(<\/span>)<\/span>
              \n .<\/span>requestMatchers<\/span>(<\/span>"\/public\/**"<\/span>)<\/span>.<\/span>permitAll<\/span>(<\/span>)<\/span>
              \n .<\/span>requestMatchers<\/span>(<\/span>"\/actuator\/health"<\/span>)<\/span>.<\/span>permitAll<\/span>(<\/span>)<\/span>
              \n \/\/ \u7ba1\u7406\u63a5\u53e3<\/span>
              \n .<\/span>requestMatchers<\/span>(<\/span>"\/admin\/**"<\/span>)<\/span>.<\/span>hasRole<\/span>(<\/span>"ADMIN"<\/span>)<\/span>
              \n \/\/ \u5176\u4ed6\u6240\u6709\u8bf7\u6c42\u9700\u8981\u8ba4\u8bc1<\/span>
              \n .<\/span>anyRequest<\/span>(<\/span>)<\/span>.<\/span>authenticated<\/span>(<\/span>)<\/span>
              \n )<\/span><\/p>\n

              \/\/ \u5f02\u5e38\u5904\u7406<\/span>
              \n .<\/span>exceptionHandling<\/span>(<\/span>exception -><\/span> exception
              \n .<\/span>authenticationEntryPoint<\/span>(<\/span>authEntryPoint)<\/span> \/\/ 401<\/span>
              \n .<\/span>accessDeniedHandler<\/span>(<\/span>accessDeniedHandler)<\/span> \/\/ 403<\/span>
              \n )<\/span><\/p>\n

              \/\/ \u6dfb\u52a0JWT\u8fc7\u6ee4\u5668（\u5728UsernamePasswordAuthenticationFilter\u4e4b\u524d）<\/span>
              \n .<\/span>addFilterBefore<\/span>(<\/span>jwtAuthenticationFilter,<\/span>
              \n UsernamePasswordAuthenticationFilter<\/span>.<\/span>class<\/span>)<\/span>;<\/span><\/p>\n

              return<\/span> http.<\/span>build<\/span>(<\/span>)<\/span>;<\/span>
              \n }<\/span><\/p>\n

              @Bean<\/span>
              \n public<\/span> PasswordEncoder<\/span> passwordEncoder<\/span>(<\/span>)<\/span> {<\/span>
              \n return<\/span> new<\/span> BCryptPasswordEncoder<\/span>(<\/span>)<\/span>;<\/span> \/\/ \u5bc6\u7801\u52a0\u5bc6<\/span>
              \n }<\/span><\/p>\n

              @Bean<\/span>
              \n public<\/span> AuthenticationManager<\/span> authenticationManager<\/span>(<\/span>
              \n AuthenticationConfiguration<\/span> config)<\/span> throws<\/span> Exception<\/span> {<\/span>
              \n return<\/span> config.<\/span>getAuthenticationManager<\/span>(<\/span>)<\/span>;<\/span>
              \n }<\/span>
              \n}<\/span><\/p>\n

              8.2 \u81ea\u5b9a\u4e49\u5f02\u5e38\u5904\u7406<\/h4>\n

              @Component<\/span>
              \npublic<\/span> class<\/span> AuthEntryPoint<\/span> implements<\/span> AuthenticationEntryPoint<\/span> {<\/span>
              \n @Override<\/span>
              \n public<\/span> void<\/span> commence<\/span>(<\/span>HttpServletRequest<\/span> request,<\/span>
              \n HttpServletResponse<\/span> response,<\/span>
              \n AuthenticationException<\/span> authException)<\/span> throws<\/span> IOException<\/span> {<\/span>
              \n response.<\/span>setContentType<\/span>(<\/span>"application\/json;charset=UTF-8"<\/span>)<\/span>;<\/span>
              \n response.<\/span>setStatus<\/span>(<\/span>401<\/span>)<\/span>;<\/span>
              \n response.<\/span>getWriter<\/span>(<\/span>)<\/span>.<\/span>write<\/span>(<\/span>"{\\\\"code\\\\":401,\\\\"message\\\\":\\\\"\u672a\u8ba4\u8bc1，\u8bf7\u5148\u767b\u5f55\\\\"}"<\/span>)<\/span>;<\/span>
              \n }<\/span>
              \n}<\/span><\/p>\n

              @Component<\/span>
              \npublic<\/span> class<\/span> CustomAccessDeniedHandler<\/span> implements<\/span> AccessDeniedHandler<\/span> {<\/span>
              \n @Override<\/span>
              \n public<\/span> void<\/span> handle<\/span>(<\/span>HttpServletRequest<\/span> request,<\/span>
              \n HttpServletResponse<\/span> response,<\/span>
              \n AccessDeniedException<\/span> accessDeniedException)<\/span> throws<\/span> IOException<\/span> {<\/span>
              \n response.<\/span>setContentType<\/span>(<\/span>"application\/json;charset=UTF-8"<\/span>)<\/span>;<\/span>
              \n response.<\/span>setStatus<\/span>(<\/span>403<\/span>)<\/span>;<\/span>
              \n response.<\/span>getWriter<\/span>(<\/span>)<\/span>.<\/span>write<\/span>(<\/span>"{\\\\"code\\\\":403,\\\\"message\\\\":\\\\"\u6743\u9650\u4e0d\u8db3\\\\"}"<\/span>)<\/span>;<\/span>
              \n }<\/span>
              \n}<\/span><\/p>\n

              \n

              🛡\ufe0f \u7b2c\u4e5d\u5e55：\u5b89\u5168\u6700\u4f73\u5b9e\u8df5<\/h3>\n

              \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

              9.1 Token\u5b58\u50a8\u5b89\u5168<\/h4>\n

              \u88684：Token\u5b58\u50a8\u65b9\u6848\u5bf9\u6bd4<\/p>\n\n\u5b58\u50a8\u65b9\u5f0fXSS\u98ce\u9669CSRF\u98ce\u9669\u63a8\u8350\u5ea6\u8bf4\u660e<\/tr>\n\n\n\n\n\n\n
              localStorage<\/td>\n\u274c \u9ad8（JS\u53ef\u8bfb）<\/td>\n\u2705 \u4f4e<\/td>\n\u2b50\u2b50<\/td>\n\u4e0d\u63a8\u8350\u5b58\u654f\u611fToken<\/td>\n<\/tr>\n
              sessionStorage<\/td>\n\u274c \u9ad8（JS\u53ef\u8bfb）<\/td>\n\u2705 \u4f4e<\/td>\n\u2b50\u2b50<\/td>\n\u540c\u4e0a<\/td>\n<\/tr>\n
              Cookie (\u666e\u901a)<\/td>\n\u2705 \u4f4e<\/td>\n\u274c \u9ad8（\u81ea\u52a8\u643a\u5e26）<\/td>\n\u2b50\u2b50\u2b50<\/td>\n\u9700\u8981CSRF\u9632\u62a4<\/td>\n<\/tr>\n
              Cookie (HttpOnly+Secure+SameSite)<\/td>\n\u2705 \u65e0<\/td>\n\u2705 \u4f4e<\/td>\n\u2b50\u2b50\u2b50\u2b50\u2b50<\/td>\n\u63a8\u8350<\/td>\n<\/tr>\n
              \u5185\u5b58\u53d8\u91cf (JS)<\/td>\n\u2705 \u4f4e（\u9875\u9762\u5237\u65b0\u4e22\u5931）<\/td>\n\u2705 \u4f4e<\/td>\n\u2b50\u2b50\u2b50\u2b50<\/td>\nAccess Token\u63a8\u8350<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

              \u6700\u4f73\u5b9e\u8df5：<\/p>\n

                \n
              • Access Token：\u5b58\u5728JS\u5185\u5b58\u53d8\u91cf\u4e2d（\u9875\u9762\u5237\u65b0\u4e22\u5931 \u2192 \u7528Refresh Token\u91cd\u65b0\u83b7\u53d6）<\/li>\n
              • Refresh Token：\u5b58\u5728HttpOnly + Secure + SameSite=Strict\u7684Cookie\u4e2d<\/li>\n<\/ul>\n

                9.2 Cookie\u5b89\u5168\u6807\u5fd7<\/h4>\n

                ResponseCookie<\/span> cookie =<\/span> ResponseCookie<\/span>.<\/span>from<\/span>(<\/span>"refreshToken"<\/span>,<\/span> token)<\/span>
                \n .<\/span>httpOnly<\/span>(<\/span>true<\/span>)<\/span> \/\/ JS\u65e0\u6cd5\u901a\u8fc7document.cookie\u8bfb\u53d6（\u9632XSS）<\/span>
                \n .<\/span>secure<\/span>(<\/span>true<\/span>)<\/span> \/\/ \u53ea\u5728HTTPS\u8fde\u63a5\u4e0b\u4f20\u8f93（\u9632\u4e2d\u95f4\u4eba）<\/span>
                \n .<\/span>sameSite<\/span>(<\/span>"Strict"<\/span>)<\/span> \/\/ \u8de8\u7ad9\u8bf7\u6c42\u4e0d\u643a\u5e26Cookie（\u9632CSRF）<\/span>
                \n .<\/span>path<\/span>(<\/span>"\/"<\/span>)<\/span> \/\/ Cookie\u7684\u4f5c\u7528\u8def\u5f84<\/span>
                \n .<\/span>maxAge<\/span>(<\/span>7<\/span> *<\/span> 24<\/span> *<\/span> 3600<\/span>)<\/span> \/\/ 7\u5929\u8fc7\u671f<\/span>
                \n .<\/span>build<\/span>(<\/span>)<\/span>;<\/span><\/p>\n

                9.3 \u5bc6\u7801\u5b89\u5168<\/h4>\n

                \/\/ BCrypt\u52a0\u5bc6（\u6bcf\u6b21\u7ed3\u679c\u4e0d\u540c，\u56e0\u4e3a\u52a0\u4e86\u968f\u673a\u76d0）<\/span>
                \nString<\/span> encoded =<\/span> passwordEncoder.<\/span>encode<\/span>(<\/span>"myPassword"<\/span>)<\/span>;<\/span>
                \n\/\/ $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy<\/span><\/p>\n

                \/\/ \u9a8c\u8bc1<\/span>
                \nboolean<\/span> matches =<\/span> passwordEncoder.<\/span>matches<\/span>(<\/span>"myPassword"<\/span>,<\/span> encoded)<\/span>;<\/span> \/\/ true<\/span><\/p>\n

                \"\u5728\u8fd9\u91cc\u63d2\u5165\u56fe\u7247\u63cf\u8ff0\"<\/p>\n

                \u88685：\u5b89\u5168Checklist<\/p>\n\n#\u68c0\u67e5\u9879\u4f18\u5148\u7ea7\u8bf4\u660e<\/tr>\n\n\n\n\n\n\n\n\n\n\n\n
                1<\/td>\nJWT secret \u2265 256\u4f4d\u968f\u673a\u5bc6\u94a5<\/td>\nP0<\/td>\n\u4e0d\u8981\u7528"123456"<\/td>\n<\/tr>\n
                2<\/td>\nAccess Token \u2264 30\u5206\u949f<\/td>\nP0<\/td>\n\u6cc4\u9732\u5371\u5bb3\u6709\u9650<\/td>\n<\/tr>\n
                3<\/td>\nRefresh Token\u5b58HttpOnly Cookie<\/td>\nP0<\/td>\n\u9632XSS\u7a83\u53d6<\/td>\n<\/tr>\n
                4<\/td>\nBCrypt\u52a0\u5bc6\u5bc6\u7801（cost=12）<\/td>\nP0<\/td>\n\u4e0d\u8981\u7528MD5\/SHA<\/td>\n<\/tr>\n
                5<\/td>\n\u767b\u5f55\u5931\u8d25\u9650\u6d41（5\u6b21\/15\u5206\u949f）<\/td>\nP0<\/td>\n\u9632\u66b4\u529b\u7834\u89e3<\/td>\n<\/tr>\n
                6<\/td>\nRefresh Token Rotation<\/td>\nP1<\/td>\n\u9632Token\u76d7\u7528<\/td>\n<\/tr>\n
                7<\/td>\nHTTPS\u5168\u7ad9<\/td>\nP0<\/td>\n\u9632\u4e2d\u95f4\u4eba\u653b\u51fb<\/td>\n<\/tr>\n
                8<\/td>\nCORS\u4e25\u683c\u914d\u7f6e<\/td>\nP1<\/td>\n\u53ea\u5141\u8bb8\u4fe1\u4efb\u7684\u57df<\/td>\n<\/tr>\n
                9<\/td>\n\u5ba1\u8ba1\u65e5\u5fd7（\u767b\u5f55\/\u767b\u51fa\/\u5931\u8d25）<\/td>\nP1<\/td>\n\u5b89\u5168\u4e8b\u4ef6\u8ffd\u6eaf<\/td>\n<\/tr>\n
                10<\/td>\nRedis\u9ad8\u53ef\u7528（Sentinel\/Cluster）<\/td>\nP1<\/td>\n\u907f\u514d\u5355\u70b9\u6545\u969c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
                \n

                🌟 \u7ed3\u8bed<\/h3>\n

                \u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u770b\u4f3c\u590d\u6742，\u4f46\u6838\u5fc3\u601d\u60f3\u5f88\u7b80\u5355：<\/p>\n

              • Access Token = \u201c\u901a\u884c\u8bc1\u201d，\u77ed\u547d\u4f46\u5feb（\u65e0\u72b6\u6001，\u4e0d\u67e5\u5e93）<\/li>\n
              • Refresh Token = \u201c\u7eed\u547d\u7b26\u201d，\u957f\u547d\u4f46\u53ef\u63a7（\u6709\u72b6\u6001，\u5b58Redis）<\/li>\n
              • Spring Security Filter Chain = \u201c\u5b89\u68c0\u7cfb\u7edf\u201d，\u6bcf\u4e2a\u8bf7\u6c42\u90fd\u8981\u8fc7\u5b89\u68c0<\/li>\n
              • Redis\u9ed1\u540d\u5355 = \u201c\u4f5c\u5e9f\u516c\u544a\u201d，\u8ba9\u5df2\u767b\u51fa\u7684Token\u5931\u6548<\/li>\n
              • RBAC\u6743\u9650 = \u201c\u95e8\u7981\u5361\u7ea7\u522b\u201d，\u4e0d\u540c\u89d2\u8272\u80fd\u8fdb\u4e0d\u540c\u7684\u95e8<\/li>\n

                \u201c\u8ba4\u8bc1\u7684\u672c\u8d28\u662f\u8bc1\u660e\u2019\u4f60\u662f\u4f60\u2019，\u6388\u6743\u7684\u672c\u8d28\u662f\u51b3\u5b9a\u2019\u4f60\u80fd\u505a\u4ec0\u4e48\u2019\u3002\u53ccToken\u4f53\u7cfb\u628a\u8fd9\u4e24\u4ef6\u4e8b\u5206\u5f00\u5904\u7406：Access Token\u8bc1\u660e\u8eab\u4efd+\u643a\u5e26\u6743\u9650，Refresh Token\u7ba1\u7406\u767b\u5f55\u72b6\u6001\u3002\u5206\u5de5\u660e\u786e，\u5404\u53f8\u5176\u804c\u3002\u201d<\/p>\n

                \n

                📚 \u53c2\u8003\u6587\u732e<\/h3>\n
              • Internet Engineering Task Force. \u201cJSON Web Token (JWT).\u201d RFC 7519, 2015. https:\/\/www.rfc-editor.org\/rfc\/rfc7519<\/li>\n
              • Internet Engineering Task Force. \u201cJSON Web Signature (JWS).\u201d RFC 7515, 2015. https:\/\/www.rfc-editor.org\/rfc\/rfc7515<\/li>\n
              • Spring Security Reference Documentation. \u201cAuthentication Architecture.\u201d https:\/\/docs.spring.io\/spring-security\/reference\/servlet\/authentication\/architecture.html<\/li>\n
              • Spring Security Reference Documentation. \u201cAuthorization.\u201d https:\/\/docs.spring.io\/spring-security\/reference\/servlet\/authorization\/index.html<\/li>\n
              • OAuth 2.0 RFC 6749. \u201cThe OAuth 2.0 Authorization Framework.\u201d IETF, 2012. https:\/\/www.rfc-editor.org\/rfc\/rfc6749<\/li>\n
              • Auth0 Blog. \u201cRefresh Token Rotation.\u201d https:\/\/auth0.com\/blog\/refresh-tokens-what-are-they-and-when-to-use-them\/<\/li>\n
              • OWASP. \u201cJSON Web Token Cheat Sheet.\u201d https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/JSON_Web_Token_for_Java_Cheat_Sheet.html<\/li>\n
              • Spring Boot Reference Documentation. \u201cSpring Security.\u201d https:\/\/docs.spring.io\/spring-boot\/reference\/web\/spring-security.html<\/li>\n
              • Redis Documentation. \u201cEXPIRE \/ SETEX \/ TTL Commands.\u201d https:\/\/redis.io\/commands\/<\/li>\n
              • <\/li>\n","protected":false},"excerpt":{"rendered":"

                \u4f60\u4ee5\u4e3a\u767b\u5f55\u5c31\u662f\\”\u7528\u6237\u540d\u5bc6\u7801\u6362\u4e00\u4e2aToken\\”？\u5f53\u4f60\u7684\u7cfb\u7edf\u9700\u8981\\”\u8e22\u4eba\u4e0b\u7ebf\\”\u3001\u201c\u5355\u8bbe\u5907\u767b\u5f55\u201d\u3001\\”Token\u65e0\u611f\u5237\u65b0\\”\u65f6，\u4e00\u5207\u90fd\u53d8\u4e86\u3002 \u2014\u2014 \u4e00\u7bc7\u7528\u4ee3\u7801\u6d41\u7a0b\u62c6\u89e3\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u7684\u5b9e\u6218\u624b\u518c \u9605\u8bfb\u65f6\u95f4：\u7ea645\u5206\u949f | \u6db5\u76d6：\u53ccToken\u539f\u7406 \/ Spring Security\u8fc7\u6ee4\u94fe \/ JWT\u751f\u6210\u4e0e\u6821\u9a8c \/ Redis\u9ed1\u540d\u5355 \/ RBAC\u6743\u9650 \/ Token\u5237\u65b0 \/ \u5b89\u5168\u5b9e\u8df5 📑 \u76ee\u5f55
                \n\u5e8f\u7ae0：\u4e3a<\/p>\n","protected":false},"author":2,"featured_media":95073,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[105,101,1862],"topic":[],"class_list":["post-95084","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-server","tag-redis","tag-spring","tag-wpf"],"yoast_head":"\n\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/95084.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u4f60\u4ee5\u4e3a\u767b\u5f55\u5c31\u662f"\u7528\u6237\u540d\u5bc6\u7801\u6362\u4e00\u4e2aToken"？\u5f53\u4f60\u7684\u7cfb\u7edf\u9700\u8981"\u8e22\u4eba\u4e0b\u7ebf"\u3001\u201c\u5355\u8bbe\u5907\u767b\u5f55\u201d\u3001"Token\u65e0\u611f\u5237\u65b0"\u65f6，\u4e00\u5207\u90fd\u53d8\u4e86\u3002 \u2014\u2014 \u4e00\u7bc7\u7528\u4ee3\u7801\u6d41\u7a0b\u62c6\u89e3\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u7684\u5b9e\u6218\u624b\u518c \u9605\u8bfb\u65f6\u95f4：\u7ea645\u5206\u949f | \u6db5\u76d6：\u53ccToken\u539f\u7406 \/ Spring Security\u8fc7\u6ee4\u94fe \/ JWT\u751f\u6210\u4e0e\u6821\u9a8c \/ Redis\u9ed1\u540d\u5355 \/ RBAC\u6743\u9650 \/ Token\u5237\u65b0 \/ \u5b89\u5168\u5b9e\u8df5 📑 \u76ee\u5f55 \u5e8f\u7ae0：\u4e3a\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/95084.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-16T00:25:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260816002521-6a810371d0308.jpg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/95084.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/95084.html\",\"name\":\"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-08-16T00:25:29+00:00\",\"dateModified\":\"2026-08-16T00:25:29+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/95084.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/95084.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/95084.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/95084.html","og_locale":"zh_CN","og_type":"article","og_title":"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u4f60\u4ee5\u4e3a\u767b\u5f55\u5c31\u662f\"\u7528\u6237\u540d\u5bc6\u7801\u6362\u4e00\u4e2aToken\"？\u5f53\u4f60\u7684\u7cfb\u7edf\u9700\u8981\"\u8e22\u4eba\u4e0b\u7ebf\"\u3001\u201c\u5355\u8bbe\u5907\u767b\u5f55\u201d\u3001\"Token\u65e0\u611f\u5237\u65b0\"\u65f6，\u4e00\u5207\u90fd\u53d8\u4e86\u3002 \u2014\u2014 \u4e00\u7bc7\u7528\u4ee3\u7801\u6d41\u7a0b\u62c6\u89e3\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u7684\u5b9e\u6218\u624b\u518c \u9605\u8bfb\u65f6\u95f4：\u7ea645\u5206\u949f | \u6db5\u76d6：\u53ccToken\u539f\u7406 \/ Spring Security\u8fc7\u6ee4\u94fe \/ JWT\u751f\u6210\u4e0e\u6821\u9a8c \/ Redis\u9ed1\u540d\u5355 \/ RBAC\u6743\u9650 \/ Token\u5237\u65b0 \/ \u5b89\u5168\u5b9e\u8df5 📑 \u76ee\u5f55 \u5e8f\u7ae0：\u4e3a","og_url":"https:\/\/www.wsisp.com\/helps\/95084.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-08-16T00:25:29+00:00","og_image":[{"url":"https:\/\/www.wsisp.com\/helps\/wp-content\/uploads\/2026\/08\/20260816002521-6a810371d0308.jpg"}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"19 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/95084.html","url":"https:\/\/www.wsisp.com\/helps\/95084.html","name":"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-08-16T00:25:29+00:00","dateModified":"2026-08-16T00:25:29+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/95084.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/95084.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/95084.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u53ccToken\u8ba4\u8bc1\u4f53\u7cfb\u6df1\u5ea6\u62c6\u89e3\uff1aSpring Security + JWT + Redis"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/95084","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=95084"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/95084\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media\/95073"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=95084"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=95084"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=95084"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=95084"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}